4 Things we Learned About WP2Shell This Week

On July 17, 2026, WordPress shipped emergency patches for two vulnerabilities that, when chained together, hand an anonymous attacker complete control of a default WordPress installation without requiring plugins, credentials, or any special configuration, and three days after the patch dropped, active exploitation was already confirmed in the wild. One of the two CVEs received a critical CVSS score of 9.8.

Here is what the past week established.

1. The attack requires nothing from the victim

What separates WP2Shell from the vast majority of WordPress vulnerabilities is that it lives in core rather than in a plugin or theme, which means the exposure exists regardless of what a site has installed on top of it. CVE-2026-60137 is a high-severity SQL injection flaw and CVE-2026-63030 is a critical arbitrary code execution vulnerability that, when chained, enable an attacker to achieve unauthenticated remote code execution, with Searchlight Cyber warning that “the attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.”

Once inside, the attacker’s path is straightforward: the SQL injection allows extraction of administrator password hashes from the database for offline cracking, after which the attacker can drop a persistent webshell and maintain access long after the initial exploit window closes. We covered this story first in our cyber roundup for the week of July 20 — this post goes deeper on what the exploitation timeline means for your environment.

2. Exploitation went public faster than most patches reach production

WordPress released version 7.0.2 on Friday July 17, and by Sunday July 19, VulnCheck had already verified more than two dozen unique proof-of-concept exploits targeting WP2Shell, with VulnCheck Canaries confirming active in-the-wild exploitation by July 20, three days after the patch shipped. The timing of the release compounded the problem considerably: pushing a critical patch on a Friday afternoon US time, Friday evening in Europe, gave threat actors the entire weekend to analyse the fix and build working exploits before most enterprise patch cycles had even registered the advisory. WatchTowr’s honeypots subsequently recorded tens of thousands of exploitation attempts and more than 100 backdoor accounts created by different threat actors using variations of public tooling, with watchTowr noting it was able to trivially reproduce CVE-2026-63030 within minutes of the disclosure being published.

3. The exposed population is larger than most organisations assumed

WordPress powers approximately 43% of all websites globally, and the WP2Shell chain affects every default installation running versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Wiz data found that 60% of organisations using WordPress had at least one vulnerable instance at the time the CVEs were published, and 25% were actively exposing a vulnerable server to the internet. That last figure is the one that matters most for security teams, because it represents the population of sites an unauthenticated attacker could reach without any prior access to the environment. Due to the severity, the WordPress.org team enabled forced updates via the auto-update system for sites running affected versions, a measure WordPress reserves for situations where the risk of leaving sites unpatched is judged to outweigh the disruption of an unexpected update.

4. A forced auto-update is not a reason to stop checking

The wider point

WP2Shell is a core vulnerability in the most widely deployed CMS on the internet, discovered using an AI model, turned into working exploits within hours of disclosure, and actively hitting organisations whose patch processes could not keep pace with that window. The uncomfortable question for most security teams is not whether to patch the WordPress sites they know about, but how many instances exist across subsidiary domains, vendor-managed sites, and forgotten marketing microsites that nobody has mapped and that are reachable from the internet right now. That is the gap that external attack surface management exists to close.

CybelAngel maps your full external digital footprint continuously, including WordPress instances across every domain and subdomain you own, and surfaces vulnerable versions before an attacker finds them first.