wp2shell is being exploited: verify your WordPress patch

We wrote about the WordPress 7.0.2 emergency release on July 19 and noted there were no confirmed reports of exploitation yet. That quiet period is over. As of July 20, 2026, multiple security firms have independently confirmed that the wp2shell vulnerability chain is being exploited in the wild. If you run WordPress, today's job is not to patch — it's to verify that the patch actually landed.

What actually happened

wp2shell chains two bugs: CVE-2026-60137, a high-severity SQL injection, and CVE-2026-63030, a critical arbitrary code execution flaw. Together they give an unauthenticated attacker remote code execution on the box. Adam Kues at Searchlight Cyber found it. Affected versions are WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; the fixes are 7.0.2 and 6.9.5.

WordPress security firm Patchstack has logged exploitation attempts. Hexastrike saw attacks in its honeypots over the weekend of July 18–19 and later confirmed it assisted with incident response on active compromises. watchTowr has observed in-the-wild attempts too, and its CEO Benjamin Harris made the point that should reset your patching assumptions: the disclosure-to-exploitation window has collapsed from a day-plus to hours, as SecurityWeek reports.

Scale is ugly and imprecise. TechCrunch reports that official WordPress stats show over 400 million sites on affected versions, and cites security consultant Daniel Card's sample-based estimate that under 15% remain unpatched — which projects to roughly 90 million exposed sites. Treat that as an order-of-magnitude estimate, not a census. The direction is what matters.

Why patch verification matters for your business

WordPress.org enabled forced automatic updates for affected installs. That is genuinely good, and it is also exactly why people are about to get owned. Forced auto-update is a delivery mechanism, not a guarantee. It fails quietly on sites with file permissions locked down, DISALLOW_FILE_MODS set, a managed host that pins core versions, staging clones nobody remembers, or a plugin that broke the updater six months ago. The sites most likely to silently miss the update are the ones that have been running untouched for years — which describes most small-business WordPress.

So go look. Admin dashboard, or wp core version over SSH. You want 7.0.2 or 6.9.5 or newer. Check every install, including the marketing microsite and the staging box on a subdomain. Then check for what came before the patch: unfamiliar admin users, new PHP files with recent timestamps in wp-content/uploads, outbound connections you can't explain. Patching a compromised site closes the door on a burglar who is already inside.

Sources: TechCrunch, SecurityWeek, Tenable wp2shell FAQ.