wp2shell is a combination of two WordPress vulnerabilities, patched on 17 July 2026, that together allowed an attacker to take over a WordPress installation without logging in or any user interaction.

Which WordPress versions fix wp2shell?

WordPress 7.0.2, 6.9.5 and 6.8.6 fix it for their branches. Anything older than 6.8 did not receive the fix and should be upgraded.

Was my site hacked if I updated late?

Possibly. Sites that ran an affected version after the patch was published may have been attacked before they updated. Check for unknown admin users and recently changed files, and change passwords.

Can your free check tell if I am affected?

If your site shows its WordPress version publicly, yes: the check compares it against the fixed releases and reflects it in your score. We share the details with you privately rather than on screen.

Security guide

wp2shell: is your WordPress site exposed?

wp2shell is the name given to two WordPress vulnerabilities that, chained together, let an attacker take over a WordPress site without logging in and without anyone clicking anything. They were patched on 17 July 2026. Sites that have not updated since are at serious risk.

Run the free security check

Which WordPress versions are affected

WordPress 7.0.x before 7.0.2
WordPress 6.9.x before 6.9.5
WordPress 6.8.x before 6.8.6 (affected by one of the two flaws)
Older branches never received the fix, so anything below 6.8 should be treated as exposed

The fixed releases are 7.0.2, 6.9.5 and 6.8.6 or later.

How to check your version

Log in to WordPress and look at Dashboard → Updates, which shows the version and any update waiting. Many sites also print the version in their page source as a “generator” tag, which is how our free check reads it without logging in.

What to do if you are on an affected version

Back up the site and database.
Update WordPress to a fixed release straight away, then update every plugin and theme.
Because the flaw was being exploited, check for signs of compromise: admin users you do not recognise, files changed recently in wp-content, and unexpected redirects.
Change every admin password and the database password, and rotate any API keys stored in the site.
If you find signs of a break-in, restore from a backup made before 17 July 2026 and then update.

Why automatic updates did not save everyone

WordPress applies minor security releases automatically by default, but plenty of sites have that switched off, have hosting that blocks it, or are on an old major version that no longer receives updates. Those are the sites wp2shell still catches.

Questions people ask

What is wp2shell?: wp2shell is a combination of two WordPress vulnerabilities, patched on 17 July 2026, that together allowed an attacker to take over a WordPress installation without logging in or any user interaction.
Which WordPress versions fix wp2shell?: WordPress 7.0.2, 6.9.5 and 6.8.6 fix it for their branches. Anything older than 6.8 did not receive the fix and should be upgraded.
Was my site hacked if I updated late?: Possibly. Sites that ran an affected version after the patch was published may have been attacked before they updated. Check for unknown admin users and recently changed files, and change passwords.
Can your free check tell if I am affected?: If your site shows its WordPress version publicly, yes: the check compares it against the fixed releases and reflects it in your score. We share the details with you privately rather than on screen.

Check your own site in thirty seconds

Our free, passive scan gives you a security score and grade, checks for the issues on this page, and keeps the details private. If you want them fixed, the Security fix package is a fixed price agreed up front.

Run the free security check About the Security fix