Was my WordPress site affected by wp2shell?
Short answer: if your site runs WordPress 6.9 or 7.0 and the version is older than 6.9.5 or 7.0.2, it is potentially affected and should be updated now. WordPress 6.8 before 6.8.6 has one of the two flaws. WordPress 6.7 and older are not affected. If your site hides its WordPress version, we cannot tell. Paste your address below for a free check.
This is an earlier wave. We added this page afterwards as background; it was not published when the flaw was disclosed. Last updated: 26 October 2026.
What happened
On 17 July 2026 WordPress released version 7.0.2, with fixes for two flaws in WordPress core: CVE-2026-63030 and CVE-2026-60137. Together they became known as wp2shell. On WordPress 6.9 and 7.0, someone who is not logged in could chain them to run their own code on the server. WordPress 6.8 has only the second flaw, an SQL injection that needs a plugin or theme to pass untrusted input to WordPress.
WordPress.org pushed the update to affected sites through the automatic update system. Attacks were reported within days. On 21 July 2026 the US cybersecurity agency CISA added both flaws to its catalogue of vulnerabilities known to be exploited.
The flaws are in WordPress itself, not in a plugin or theme, so the fix is a WordPress update.
Which versions are fixed
| WordPress line | Affected | Fixed in |
|---|---|---|
| 7.0 | 7.0.0 to 7.0.1 | 7.0.2 |
| 6.9 | 6.9.0 to 6.9.4 | 6.9.5 |
| 6.8 | 6.8.0 to 6.8.5 (SQL injection only) | 6.8.6 |
| 6.7 and older | not affected | - |
What our check can and cannot tell you
We look at your site from the outside, the way any visitor does. We read the WordPress version your site shows, usually in its generator tag, and compare it with the table above. We do not test the flaw.
- Potentially affected: your site shows a WordPress version in the affected range. We say potentially because a version tag can be out of date or cached. Update WordPress, then run the check again.
- Cannot tell: your site runs WordPress but hides the version. That is good practice, but we will not guess. Look under Dashboard, Updates, or ask your developer.
- No sign of this problem: your site shows a fixed version, a version older than 6.8, or no WordPress at all. This is "no sign from the outside", not a guarantee.
What to do
- Check your version under Dashboard, Updates in the WordPress admin. The automatic update may already have run.
- Update to 7.0.2, 6.9.5 or 6.8.6 or newer, or better, to the current WordPress release. Make a backup first.
- If your site ran an affected version for some time after 17 July 2026, ask your developer or host to look for signs of a break-in, such as unknown admin accounts or new PHP files. Updating closes the hole but does not remove anything an attacker left behind.
- Run this check again after the update.
Official sources
- WordPress.org: WordPress 7.0.2 Release
- WordPress security advisory for CVE-2026-63030: GHSA-ff9f-jf42-662q
- WordPress security advisory for CVE-2026-60137: GHSA-fpp7-x2x2-2mjf
- CISA: Known Exploited Vulnerabilities catalog (both CVEs added 21 July 2026)
- NCSC New Zealand: CVE-2026-63030 and CVE-2026-60137 affecting WordPress
Scanylo is not affiliated with WordPress.org or CISA. This page is a plain-language summary, not a replacement for the advisories. This is a passive, external check and not a penetration test.
Why this page exists
This is an earlier wave, kept on the wave radar as background. We added the page afterwards; it was not published when the flaw was disclosed on 2026-07-17. Sites that never updated can still be exposed, so the check still runs.
Every time a major vulnerability wave hits the news, Scanylo publishes a check page within 24 hours. Tick the email alert box above and we will re-check your site on every new wave and tell you the result. It is free and needs no account. The check is passive: we read the version your site shows to any visitor and nothing else. Methodology.