Something probably brought you here. A client asking about “wp2shell.” An email from your host. Or you just noticed your site doing something it shouldn’t.
Whatever it was, let’s talk about it plainly.
There’s a nasty WordPress vulnerability going around, officially tagged CVE-2026-63030, paired with a second bug, CVE-2026-60137. Security researchers nicknamed the combo “wp2shell,” and that name isn’t cute branding. It tells you exactly what attackers are doing with it once they’re in.
What makes this one different from the usual “a plugin had a bug” story is that it lives inside WordPress core. Not a plugin. Not a theme. Core.
That’s the detail that should worry you a little, because it means being careful about which plugins you install didn’t protect you here. A brand new install with nothing added to it could still be exploited. I’ve been building WordPress sites for a long time, and bugs like this, ones that hit core directly, don’t come around often. When they do, they move fast.
Working exploit code was public within days of disclosure. Both CVEs landed on CISA’s known-exploited list. One tracking dashboard put patch adoption at roughly 4 out of 5 sites checked. That sounds fine until you do the math on how many sites that leaves wide open.
So yes, this is worth ten minutes of your attention today. Not next week.
What wp2shell actually is
I’ll skip the textbook version.
Picture your WordPress REST API as a mail room. Every request that comes through is supposed to get checked at the door: who are you, what do you want, are you allowed back here.
The bug in CVE-2026-63030 sits in the “batch” feature, the part that lets several requests get bundled and processed together. The checking and the processing don’t happen at the same moment. There’s a gap between them. That gap is the whole vulnerability.
On its own, that’s a real problem. Paired with the second bug, a SQL injection flaw that tricks your database into handing over data it shouldn’t, it turns into something worse. An attacker with no login, no password, nothing, can pull information straight out of your database and eventually run their own code on your server.
WordPress patched this in 6.8.6, 6.9.5, and 7.0.2, and pushed it through auto-updates. If your site hasn’t picked that up yet, you’re still exposed.
Here’s what I’ve actually seen attackers do once they get in through this hole:
- Install a fake plugin, usually named
wp2shellorwp2shell_followed by a random string. It looks like a plugin. It’s really a file browser and command runner sitting on your server. - Create admin accounts you never made, often with email addresses that look automated or just plain off.
- Quietly break your security plugin, Wordfence is the usual target, so it stops scanning and stops warning you.
- Drop a second webshell inside a fake “theme” folder, one that doesn’t even ask for a password before letting someone upload, edit, or delete files.
Why leave so many doors open at once? Redundancy. Find and remove one, and they’ve still got three more ways back in. That’s the part that trips people up. They fix the obvious thing and assume they’re done.
They almost never are.
Checking if your site’s been hit
You don’t need to be a developer for this. Work through it in order.
Start with your plugins. Go to Plugins → Installed Plugins. See anything called wp2shell, WP2P, or something equally odd you didn’t install? That’s your flag. Don’t delete it yet, there’s an order to this, and I’ll get there.
Then your user accounts. Users → All Users. Look at every account with Administrator access, and check the email address, not just the username. Attackers lean on throwaway or auto-generated-looking addresses. Don’t recognize an admin account? Treat it as hostile until it proves otherwise.
Check your security plugin is actually doing its job. Has Wordfence, or whatever you run, scanned recently? Is it even switched on? If it’s been silently disabled, throwing odd errors, or its files look tampered with, that’s not bad luck. That’s a symptom.
Look at your themes folder. Appearance → Themes, or if you’re comfortable with FTP, straight into /wp-content/themes/. A folder in there you didn’t install, especially one with a single file offering to upload, edit, delete, or rename files with no login needed, isn’t a theme. It’s a webshell wearing a disguise.
Check cache and uploads. /wp-content/cache/ and /wp-content/uploads/ should only ever hold things like images, CSS, or cached HTML. A .php file with a random name sitting in either one has no business being there.
One thing worth knowing going in: if you spot one of these signs, assume the rest are there too. I’ve never seen this particular attack leave just a single calling card.
Cleaning it up properly
Half-cleaning a hack is arguably worse than ignoring it, because it hands you false confidence. Do this in order, and don’t skip ahead because step three feels like the satisfying one.
- Put the site into maintenance mode first. Stops the attacker’s tools from doing anything while you work.
- Update WordPress core, every plugin, and every theme. This shuts the actual door they came through.
- Remove the fake plugin and the fake theme folder. Not just deactivate. Delete.
- Delete rogue admin accounts entirely. Downgrading the role isn’t enough. Remove them.
- Reset everything. Admin passwords, database credentials, FTP/SFTP logins, and the secret keys in wp-config.php. Assume all of it was exposed, because it plausibly was.
- Reinstall your security plugin from scratch, then run a full scan. Don’t trust files that might already be compromised.
- Go through uploads, theme files, and wp-config.php by hand. Look for stray PHP files, or a single obfuscated line quietly tacked onto the bottom of an otherwise normal file.
- Check for defacement or hidden spam links. Common side effect once someone’s had this kind of access.
Steps six through eight are where most site owners lose their nerve, and that’s fair. Nobody signs up to hunt for a single hidden line of code on a Saturday afternoon.
If you get there and you’re not confident, that’s the point to bring someone in rather than guess. A missed backdoor doesn’t sit quietly. It gets used again, usually sooner than you’d expect.
Stopping it from happening again
I tell clients the same thing every time, and it’s never the exciting answer: the basics work. They’re just boring to hear.
Keep WordPress, themes, and plugins updated, and turn on auto-updates where you can. This bug was patched within days of being found, so sites with auto-updates on were protected without anyone lifting a finger.
Use a different password for everything, admin login, hosting, FTP, database, and put them in a password manager. Reused passwords are still, after all these years, the single most common thing that turns a small incident into a very bad week.
Turn on two-factor authentication for your WordPress login. It’s a bit of friction most people barely notice, and it stops the majority of automated break-in attempts on its own.
Be choosy about where plugins and themes come from. Stick to the official repository or vendors with a real track record, and if you’re not using something, remove it. Don’t leave it deactivated and gathering dust.
Run malware scans regularly, not once a year. You want to catch a new file within hours of it landing, not stumble across it three months later.
And keep backups somewhere other than your hosting account. If something does go wrong, a clean backup from before the attack is the fastest way back to normal. This one’s worth repeating: it’s the difference between losing an afternoon and losing a week.
Where I come in
This is the kind of problem I deal with directly. Working out how someone got in, clearing out everything they left behind, and locking the site down so it doesn’t happen twice.
Spotted a wp2shell plugin, an admin account that isn’t yours, or a security plugin that quietly stopped working? Don’t wait around to see what happens next. The longer something like this sits on a server, the more it tends to spread.
A few questions worth asking yourself right now:
- Do you actually know everyone who has admin access to your site?
- When did you last check your updates are current?
- If your site went down today, do you have a backup from before this vulnerability existed?
If any of those made you uneasy, get in touch. I’ll help you figure out what’s actually going on and fix it properly, not just patch over it.