WordPress has released an urgent security update addressing critical vulnerabilities that could allow an attacker to take control of an affected website without logging in.
The vulnerability has been referred to by security researchers as “wp2shell.” It affects WordPress core itself, which means a website may remain vulnerable even when all its plugins and themes are fully updated.
Website owners using an affected WordPress version should update immediately.
Table of Contents
What happened?
On July 17, 2026, the WordPress security team released WordPress 7.0.2 to fix one critical and one high-severity security issue.
The most serious issue involves the WordPress REST API and could allow an unauthenticated attacker to execute malicious code on a vulnerable server.
“Unauthenticated” means the attacker does not need a WordPress username, password or administrator account to attempt the attack. A vulnerable website may be targeted remotely through specially prepared requests.
The vulnerabilities are tracked as:
- CVE-2026-63030
- CVE-2026-60137
When chained together, the vulnerabilities could potentially allow an attacker to modify database queries, execute code, install backdoors, create administrator accounts, alter website content or access sensitive information.
Is this caused by a WordPress plugin?
No. This particular security issue affects WordPress core.
Updating only your plugins will not fix the vulnerability. You must update the main WordPress installation to a secure version.
You should still keep your plugins and themes updated because they may contain separate security vulnerabilities, but the immediate action required for this alert is a WordPress core update.
Which WordPress versions are affected?
The following versions require attention:
| WordPress branch | Affected versions | Secure version |
|---|---|---|
| WordPress 6.8 | Some installations on the 6.8 branch | WordPress 6.8.6 |
| WordPress 6.9 | WordPress 6.9.0 to 6.9.4 | WordPress 6.9.5 |
| WordPress 7.0 | WordPress 7.0.0 to 7.0.1 | WordPress 7.0.2 |
| WordPress 7.1 Beta | Earlier affected beta versions | WordPress 7.1 Beta 2 |
WordPress versions released before version 6.8 are not affected by these particular vulnerabilities. However, running an old WordPress version is still not recommended because it may contain other known security issues.
The safest option is to update to the latest stable WordPress release supported by your website.
How to check your current WordPress version
Log in to your WordPress administration dashboard.
Your WordPress version may be displayed on the Dashboard page under the “At a Glance” section. You can also open:
Dashboard → Updates
The page will show your current version and inform you whether an update is available.
You can also scroll to the bottom-right corner of most WordPress administration pages, where the installed version is normally displayed.
How to update WordPress from your dashboard
Before performing the update, create a complete backup of your website files and database.
After confirming that a backup is available:
- Log in to your WordPress dashboard.
- Go to Dashboard → Updates.
- Locate the WordPress core update.
- Click Update to version 7.0.2, Update to version 6.9.5, or the latest secure version shown.
- Allow the update process to complete without closing the browser window.
- Log back into the website and confirm that the pages, forms and other important features are working properly.
Depending on your configuration, WordPress may already have installed the security update automatically. You should still check the installed version instead of assuming the update was successful.
How to update WordPress through HarmonWeb cPanel
HarmonWeb customers can also check and update their WordPress installation through cPanel.
Log in to your HarmonWeb client account and open the cPanel account connected to the affected website.
From cPanel:
- Open WordPress Manager by Softaculous or WP Toolkit, depending on the option available in your account.
- Locate the affected WordPress website.
- Check the WordPress version displayed beside the installation.
- Create a backup before applying the update.
- Select the available WordPress core update.
- Start the update and wait for it to complete.
- Open the website and WordPress dashboard to verify that everything works correctly.
Do not select only the plugin update option. Ensure the main WordPress version is also updated.
Updating with WP-CLI
Website administrators with SSH access can check the current version by running:
wp core version
To check whether an update is available, run:
wp core check-update
Create a backup before continuing. You can then update WordPress core with:
wp core update
After the update, update the WordPress database when required:
wp core update-db
Finally, confirm the installed version:
wp core version
The command should show a patched version such as WordPress 7.0.2, 6.9.5 or another newer secure release.
What to do after updating
Updating closes the known vulnerability, but it does not automatically remove malicious changes if the website was compromised before the update.
After updating, website administrators should review the site carefully.
Check the WordPress Users page for administrator accounts that you do not recognize. Remove suspicious accounts only after confirming that they are not connected to your developer, agency or website management service.
Review recently installed plugins and themes. Delete anything you did not install or authorize.
Change the passwords for:
- WordPress administrator accounts
- cPanel
- FTP accounts
- Email accounts connected to WordPress
- Database users, where compromise is suspected
You should also regenerate WordPress security salts in the wp-config.php file to invalidate existing login sessions.
Scan the website for malware and inspect the following locations for unfamiliar PHP files or recently modified content:
/wp-content/uploads/
/wp-content/plugins/
/wp-content/themes/
/wp-includes/
/wp-admin/
The uploads directory normally contains media files. Unexpected PHP files inside it should be investigated.
Signs that a WordPress website may have been compromised
Possible warning signs include:
- Unknown WordPress administrator accounts
- Visitors being redirected to unfamiliar websites
- Spam pages appearing in search results
- Unexpected plugins or themes
- Website files changing without authorization
- Sudden increases in CPU or bandwidth usage
- Security warnings from browsers or search engines
- Modified
.htaccess,index.phporwp-config.phpfiles - Suspicious scheduled tasks or cron jobs
- Emails being sent from the hosting account without authorization
These signs do not always confirm a compromise, but they should be investigated immediately.
Should you disable the WordPress REST API?
Some security researchers have suggested temporarily restricting the affected REST API batch endpoint when an immediate update is impossible.
This should only be treated as a temporary emergency measure. Blocking the REST API may break website functionality, including plugins, mobile applications, WooCommerce features and integrations that depend on it.
Updating WordPress core remains the recommended and most reliable solution.
How to reduce future WordPress security risks
WordPress security requires continuous maintenance rather than a one-time update.
Enable automatic updates for WordPress security releases. Keep plugins and themes updated, and remove extensions that are no longer being used.
Use strong, unique passwords and enable two-factor authentication for administrator accounts. Avoid using “admin” as an administrator username.
Install plugins and themes only from trusted developers and legitimate marketplaces. Pirated or “nulled” WordPress products frequently contain hidden malware or backdoors.
Maintain regular off-site backups and periodically confirm that the backups can be restored.
Website owners should also review their WordPress dashboard regularly instead of waiting for a security incident before applying updates.
What HarmonWeb customers should do now
HarmonWeb customers running WordPress should log in to their website immediately and verify the installed WordPress version.
Update affected installations to WordPress 7.0.2, WordPress 6.9.5, WordPress 6.8.6 or a newer secure version provided by WordPress.
After updating, confirm that the website is loading correctly and review administrator accounts, plugins and files for suspicious changes.
Customers who cannot access their WordPress dashboard or experience an error during the update can contact HarmonWeb Support for assistance.
Final recommendation
Do not postpone this update because your website is small or receives limited traffic. Automated attacks usually scan large numbers of websites and may target any vulnerable installation they can reach.
Back up your website, update WordPress core immediately, verify the installed version and review the site for signs of unauthorized access.
Keeping WordPress, plugins and themes updated remains one of the most effective ways to protect your website from known vulnerabilities.
