wp2shell Is Now Being Exploited in the Wild. If You Have Not Patched, Someone Is Already Inside
We Told You to Patch on July 17. The Exploits Started on July 19.
On July 17, WordPress released emergency patches for CVE-2026-63030 and CVE-2026-60137, collectively known as wp2shell. We published a post telling you to patch immediately. Public proof-of-concept code was on GitHub within hours.
As of today, July 20, SecurityWeek confirms in-the-wild exploitation. Attackers are actively scanning for and compromising unpatched WordPress sites. This is no longer a theoretical risk. This is a breach in progress.
What We Know About the Active Attacks
The exploitation pattern follows the standard WordPress mass-compromise playbook:
- Targeting: Default WordPress installs running 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1
- Vector: POST requests to
/wp-json/batch/v1exploiting SQL injection, chained to RCE - Payload: Attackers are dropping webshells, creating new admin accounts, and injecting malicious plugins
- Scale: Mass scanning detected across multiple threat intelligence feeds as of July 19
The attack requires no authentication, no plugins, and no special configuration. If your site is reachable on the internet and runs an affected version, it is targetable.
How to Check If You Were Already Hit
Run these commands on your server now.
Check for new admin users created after July 17:
wp user list --path=/var/www/html --fields=user_login,user_email,user_registered | grep "2026-07-1[7-9]"
Check for suspicious files modified in the last 3 days:
find /var/www/html -name "*.php" -mtime -3 -not -path "*/wp-content/uploads/*"
Check access logs for the batch endpoint:
grep "batch/v1" /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null | grep "POST"
Look for unexpected plugins:
wp plugin list --path=/var/www/html --format=csv | grep -v "inactive"
If you find anything suspicious, take the site offline immediately. Restore from a backup dated before July 17. Patch before bringing it back online.
If You Still Have Not Patched
Stop reading and run this:
wp core update --path=/var/www/html
Or from the WordPress admin panel: Dashboard → Updates → Update Now.
Target versions: WordPress 7.0.2 or 6.9.5. Anything older is vulnerable.
Cloudflare and Wordfence Are Blocking It
If you use Cloudflare, their WAF rules for wp2shell were deployed on July 17. Wordfence released firewall rules the same day. If you have either of these active, you have a layer of protection even if unpatched. But this is defense in depth. Patch the core. Do not rely on WAF alone.
How ServerGurus Responded
Every WordPress site on our managed hosting was patched to 7.0.2 or 6.9.5 within 4 hours of the July 17 disclosure. Our monitoring flagged every unpatched installation across our fleet. Zero of our managed customers are vulnerable to the active exploitation.
If you run WordPress on a VPS, bare metal server, or another host and have not patched yet, you are actively being targeted right now. Contact us for emergency patching assistance.
The Timeline That Got Us Here
- July 17, 10:00 UTC: WordPress releases 7.0.2 and 6.9.5
- July 17, 14:00 UTC: PoC code appears on GitHub
- July 17, 18:00 UTC: Mass scanning begins
- July 19, 06:00 UTC: First confirmed in-the-wild exploitation
- July 20: SecurityWeek and multiple threat intel feeds confirm active compromise campaigns
The window from patch to exploitation was 44 hours. If you are still unpatched at hour 72, you are statistically likely to have been scanned. If you are unpatched and have not checked your logs, do it now.