The WordPress WP2Shell vulnerability is now being actively exploited in the wild, with cybersecurity firms warning that up to 90 million websites could still be running versions of the software that attackers can fully take over without needing a single login credential.
WordPress patched two critical flaws last week and urged administrators to update ‘immediately.’ Where forced updates were possible, it pushed them automatically. That is, to its credit, a faster response than most software vendors manage. The problem is the sheer scale of WordPress’s install base means even a small percentage of stragglers represents an enormous attack surface.
What Makes the WordPress WP2Shell Vulnerability So Dangerous
The two bugs are individually tracked as CVE-2026-63030 and CVE-2026-60137. Chained together, they enable pre-authentication remote code execution against a default WordPress installation, according to the Searchlight Cyber advisory. No plugins required. No preconditions for the attacker. A vulnerable site is, in practical terms, an open door.
The vulnerable versions are WordPress 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. The safe versions are 7.0.2 and 6.9.5, according to TechEchelon. Public proof-of-concept exploits began circulating on 18 July 2026, and according to Dark Reading, attackers moved to widespread exploitation barely three days after the vulnerabilities were first disclosed.
Jake Knott, principal security researcher at watchTowr, put it plainly in a warning quoted by Dark Reading: ‘Defenders need to inspect their WordPress instances for new administrator accounts, malicious plug-ins, or other suspicious files, regardless of whether they’ve patched.’
That last clause deserves a moment. Even patched sites may already be compromised if they ran a vulnerable version during the exposure window. Patching stops future attacks; it does not evict an attacker who is already inside.
How a Researcher, and an AI Model, Found the Flaw First
The WP2Shell chain was discovered by Adam Kues of Searchlight Cyber, though the discovery method is worth a look. According to CyberInsider, Kues had substantial assistance from an AI model, GPT-5.6 Sol Ultra, which he directed to audit a clean copy of the latest stable WordPress source code. He adapted a multi-agent research prompt originally designed for difficult mathematical problems, and crucially instructed the model to avoid changelogs and internet-based patch comparisons, so it could not simply reverse-engineer a fix that already existed.
The model identified an unauthenticated SQL injection first, then developed a multi-stage exploit that escalated database access to administrator privileges and ultimately to remote code execution. Kues shaped the process; the AI did a large share of the heavy lifting. Whether that should make defenders feel better or worse about the pace at which similar vulnerabilities will surface in future is a reasonable question to sit with.
Searchlight Cyber has released a public tool at wp2shell[.]com that allows site owners to check whether their instance is vulnerable. If an immediate update is not possible, the company recommends blocking anonymous access to the batch API as a temporary mitigation.
Scale of the Problem and What Defenders Should Do Now
WordPress’ own statistics show more than 400 million websites run the vulnerable versions, though that figure likely includes many sites that have since been patched automatically. Cybersecurity consultant Daniel Card examined a sample of around 4,200 WordPress sites and estimated that fewer than 15% remain vulnerable. Applied across the full WordPress install base, that still produces a figure of around 90 million at-risk sites.
Patchstack, Hexastrike, and watchTowr have all confirmed active exploitation. Card credited several factors for limiting the damage so far: WordPress’s forced automatic updates, Cloudflare blocking attacks against vulnerable sites, and web application firewalls providing a secondary layer of defence for sites that have them configured.
Searchlight Cyber’s attack surface management platform, branded as Assetnote, gives its customers early access to vulnerability checks, often weeks or months ahead of public disclosure. That kind of lead time is precisely what most unprotected site owners do not have right now.
For anyone running WordPress: update to version 7.0.2 or 6.9.5 immediately. Then follow Knott’s advice and audit for new administrator accounts or unfamiliar files regardless. The exploit was circulating publicly before most people had heard the name WP2Shell.
