WordPress runs a large share of the websites on the internet. That popularity is exactly why it stays a favorite target for attackers, and this month gave us a fresh reminder. A new pair of vulnerabilities known together as WP2Shell lets an attacker take full control of a WordPress site before anyone ever logs in. Working exploit code is already public, and security researchers are seeing real attacks in the wild.

Popular does not mean safe. Here is what happened, why it keeps happening, and how to find out if your own site is exposed.

What WP2Shell actually is

WP2Shell is not one bug. It is two separate weaknesses that chain together into something far worse than either one alone.

Security researchers keep track of flaws like these using a public catalog number called a CVE, which stands for Common Vulnerabilities and Exposures. Think of it as a shared case file number, so that everyone from the software maker to your own IT provider can point to the exact same problem. WP2Shell is really two of these case files working as a team.

The first, CVE-2026-63030, is a flaw in a part of WordPress that lets outside software send it commands. The second, CVE-2026-60137, lets an attacker slip hidden instructions into the database where your site keeps all of its content. On its own, that second flaw can pry loose sensitive information such as the scrambled versions of your users' passwords. Combined with the first flaw, an attacker can skip the login screen entirely and run their own programs directly on your server.

That is the worst possible outcome for a website. It means the attacker can install malware, steal customer data, redirect your visitors to a fraudulent page, or quietly use your site as a launch pad to attack others.

The full attack works against WordPress versions 6.9.0 through 7.0.1. The second flaw by itself reaches back into the 6.8 releases. Because the risk is so high, the WordPress team took the unusual step of forcing automatic security updates onto supported sites and shipped fixes in versions 6.9.5 and 7.0.2. The full technical breakdown was reported by BleepingComputer.

Why this keeps happening

If you have followed WordPress for any length of time, this story probably feels familiar. That is the real point. The problem is not a single mistake by one developer. It is the size of the target.

WordPress is built to be extended by outside plugins and themes, and that is both its greatest strength and its greatest weakness. A typical business site runs a dozen or more plugins written by different people with very different security habits. Every one of them is another door into your site, and you are trusting each author to keep that door locked. Most site owners have no realistic way to audit that code or even to know when one of those plugins stops being maintained.

Even the WordPress core, the part built and reviewed by the official team, still produces serious flaws like WP2Shell. When you stack the sprawling plugin ecosystem on top of that, you get a platform that needs constant attention just to stay safe. For a small business without a dedicated security team, that is a heavy and often invisible burden.

What to do right now

If your site runs on WordPress, treat this as urgent.

  • Confirm your version. You want to be on 6.9.5 or 7.0.2 or newer. If you are not sure which version you run, that uncertainty is itself a warning sign.
  • Turn on automatic security updates. This makes sure the next emergency fix reaches you without waiting on anyone.
  • Block the vulnerable route. Ask whoever hosts or manages your site to block the affected REST API route at the firewall until you are certain you are patched.
  • Trim your plugins. Review the plugins you actually use and remove anything you do not need. Every plugin you delete is one less door to guard.

The bigger question

Patching this one flaw is the easy part. The harder question is whether WordPress is still the right foundation for your business at all.

For many of the sites we build and manage, the answer is no. A modern static or managed platform can deliver the same look and the same features with a fraction of the attack surface, because there is no sprawling plugin layer and no public login page for attackers to hammer at all hours. Your site loads faster, costs less to maintain, and stops being a constant security chore. WordPress still makes sense for some projects, but it should be a deliberate choice rather than an automatic default.

Check your own exposure

Before you decide anything, it helps to know where you stand today. We built a free scanner that checks your website and email security in seconds. Enter your domain and it reviews your SSL certificate, your security headers, your email authentication, and your reputation on spam blocklists, then explains every result in plain language.

Try it at darkhorseitsecurity.com. Depending on how your site is set up, it can sometimes even spot the exact WordPress version you are running, which is the same clue an attacker would look for first. Either way it shows you the outward facing security posture that the rest of the world can see, and that is a smart place to begin.

If your scan turns up problems, or if you simply want an honest opinion on whether it is time to move off WordPress, get in touch. Helping businesses across Fargo and Moorhead stay secure without the constant firefighting is exactly what we do.