Blog

WordPress 7.0.2 – Update immediately. What Happened with the Recent wp2shell Vulnerability (and How to Stay Safe)

Published on: Jul 20, 2026 | < 1 min read.

If you run a WordPress website, you’ve probably seen the headlines. Just days ago, on July 17, 2026, WordPress pushed out emergency security updates for a critical vulnerability that left thousands of sites exposed. What Was the Issue? The vulnerability, dubbed wp2shell, is a chain of two flaws in WordPress core: A SQL injection (CVE-2026-60137) Combined with a REST API batch-route confusion (CVE-2026-63030) This allowed unauthenticated attackers to achieve remote code execution (RCE) on affected sites — no login required. It primarily impacted WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. WordPress responded quickly with forced automatic updates to versions 7.0.2, 6.9.5, and 6.8.6. We recently dealt ...