Your WordPress Site Is the Door: The Critical “wp2shell” Flaw (CVE-2026-63030) Every Business Must Patch Now

By Jordan Polasek · July 20, 2026

Most small businesses don't think of their website as a door into the company. But for the flaw disclosed last Friday, the website is the door — and a default WordPress site is enough to walk through it.

WordPress runs a big share of the small-business web: your storefront, your blog, your appointment page, your "contact us" form. Last week the WordPress security team shipped an emergency fix for a flaw nicknamed wp2shell — a chain of two bugs that lets an attacker with no password take over a standard WordPress site. Proof-of-concept exploit code went public the same day the patch landed, which means the clock started immediately.

⚡ The 60-Second Version

What: A pre-authentication remote code execution chain in WordPress core (nicknamed wp2shell), built from two bugs — a REST API routing flaw (CVE-2026-63030) and a SQL injection flaw (CVE-2026-60137). Chained together, an attacker who has never logged in can run code on a default WordPress site. WordPress rates the chain Critical.

Fix: Update WordPress core to 7.0.2, 6.9.5, or 6.8.6 (whichever branch you're on). Anything on 6.9.0–6.9.4 or 7.0.0–7.0.1 is exposed to the full chain; 6.8.0–6.8.5 is exposed to the SQL injection piece.

By when: Now. The patch shipped Friday, July 18, 2026, and public exploit code appeared the same day.

What wp2shell actually is

Let me translate the two pieces without the jargon.

The first bug (CVE-2026-63030) lives in WordPress's REST API — the behind-the-scenes interface that apps and plugins use to talk to your site. A "batch route" confusion lets an attacker sneak a request past the checks that are supposed to say "you're not allowed to do that."

The second bug (CVE-2026-60137) is a classic SQL injection — a way of slipping malicious commands into a database query through a normal-looking web parameter. In this case it's in the part of WordPress that filters posts by author. On its own, SQL injection lets an attacker read your database: usernames, email addresses, and the scrambled (hashed) versions of your admin passwords.

Chained together, the two turn "read the database" into "run whatever code I want on your server." That's what the shell in wp2shell means — a foothold to run commands. The researchers who found it (Adam Kues at Assetnote / Searchlight Cyber, with the SQL injection independently reported by others, all through a coordinated bug-bounty program) held back the final step of the recipe to give site owners time. But public proof-of-concept code is already circulating that confirms the database can be read — including those admin password hashes — and the window is closing fast.

Who's affected

This is the part that makes wp2shell different from most of what I write about. It doesn't take a niche firewall, a specific plugin, or an unusual configuration. It affects a default WordPress install on the recent 6.9 and 7.0 branches. The SQL injection reaches back into 6.8 as well.

If your website was built or refreshed in the last year or two — and most Texas small-business sites are on WordPress — you are very likely in the affected range unless it's already been patched. Restaurants, law firms, clinics, contractors, e-commerce shops: this cuts across every kind of business, because everybody has a website and most of them run WordPress.

The one piece of good news: because this is a flaw in WordPress core (not a plugin), the WordPress security team turned on forced automatic updates for the fix. Many sites will have quietly updated themselves over the weekend. But "many" isn't "all" — sites with auto-updates switched off, managed by an agency who disabled them, or running an unsupported older version may still be sitting exposed.

Why a hacked website is a real business problem

Owners sometimes shrug at website security — "it's just a brochure site." Here's why a broken WordPress site is worse than it sounds:

• Defacement or downtime during your busiest week, with no easy way to prove to customers you're back to normal.
• SEO poisoning and spam — attackers quietly inject pharmacy or gambling links, and Google flags your domain, tanking the search rankings you paid years to build.
• Data exposure — contact forms, appointment bookings, and small e-commerce stores hold real customer information. A read of the database can mean a reportable breach.
• A launch pad — a hijacked site can be used to phish your own customers, who trust email and links coming from your domain.

What this means for your business

Here's the short, prioritized list for this week:

• Find out what version you're on. Log into /wp-admin, go to Dashboard → Updates, and confirm you're on 7.0.2, 6.9.5, or 6.8.6 or newer. If you're not sure how, ask whoever manages the site today.
• Update core now if you're behind — and turn automatic security updates back on if someone disabled them.
• Update plugins and themes too. Attackers pile on during a window like this, and outdated plugins are the usual second door.
• Rotate your admin passwords and require multi-factor authentication on every WordPress admin account. If the database was read, those old password hashes are worth changing.
• Take a clean backup and confirm you actually know how to restore it.
• Look for signs of a visit — unfamiliar admin users, new files in the site, or unexpected redirects. If anything looks off, treat it as a possible compromise and get help before you clear it.

How BVTech helps

For our managed clients, patching like this is already handled — core updates, plugin hygiene, MFA on admin accounts, monitored backups, and someone watching for the odd new login. That's the whole point of a managed relationship: you shouldn't have to read a Friday security bulletin to stay safe.

If your website isn't managed and you're not sure whether it updated itself over the weekend, that's exactly the kind of thing worth a ten-minute check. Book a call and we'll confirm where your site stands and close the door if it's still open. You can also see how your business scores on the basics with our free Security Scoreboard.

Your website works hard for you. Let's make sure it isn't working for anyone else.

— Jordan Polasek · Founder, BVTech LLC