WordPress Vulnerability Reminds Millions Why Web Security Matters

Every so often something lands that makes the whole web sit up. On 17 July 2026, WordPress had one of those moments.

A flaw nicknamed "wp2shell" was disclosed in WordPress itself; not a plugin, not a theme, but the core software that runs somewhere around 43% of every website on the internet. Wordfence, who watch this space more closely than almost anyone, called it the first critical unauthenticated WordPress core vulnerability in nearly a decade. That word "unauthenticated" is the scary part, so let me translate it.

What actually happened, in plain English

Normally, to break into a website, an attacker needs something; a stolen password, a login, a dodgy plugin with a hole in it. wp2shell needed none of that. An attacker could send one specially crafted request to a WordPress site and take control of the server behind it. No password. No login. No plugins required. Just a WordPress site running the wrong version.

Under the bonnet it's two separate bugs chained together, a SQL injection and a REST API quirk, tracked as CVE-2026-60137 and CVE-2026-63030 if you like your labels. You don't need to remember those. What matters is the outcome: full takeover of a stock WordPress site, triggered by a stranger who's never even seen your login page.

Because the flaw lived in WordPress core, it didn't matter how tidy your plugins were or how careful you'd been. If your site was on an affected version, it was exposed.

"But I pay for a security plugin"

Here's the uncomfortable bit. A security plugin is a good thing, and I'd never tell you to bin yours. But a plugin guards the doors it knows about. wp2shell wasn't a dodgy door; it was a crack in the foundations. Plenty of the well-known security plugins only shipped protection for this after it was disclosed, and the good ones aren't cheap; you're often paying a healthy annual fee for the premium tier, and that fee still assumes someone is actually reading the alerts and acting on them.

A plugin doesn't patch your site. It doesn't check whether you were already broken into. It doesn't make the judgement call at 9pm on a Friday when a fix drops. A person does that.

The honest part

To their credit, WordPress didn't mess about. They shipped emergency fixes (versions 6.8.6, 6.9.5 and 7.0.2) and took the unusual step of force-pushing the update to sites automatically. So a lot of websites got patched without their owners lifting a finger.

That sounds like a happy ending, and for some sites it was. But that safety net has some big holes in it:

• It doesn't clean up a site that was already compromised. Within a day of disclosure, attackers were dropping hidden backdoors onto vulnerable sites and quietly creating their own admin accounts. If yours was hit in that window, the patch just locks the door after the burglar's already inside.
• Loads of sites have automatic updates switched off, usually in the name of "stability," often by a previous developer who's long gone.
• And you can't bank on a rescue next time. This one got force-pushed because it was catastrophic. The vast majority of vulnerabilities never get that treatment.

So even with a reasonably happy outcome, the sites that came out of it best were the ones with someone watching; someone to confirm the patch actually landed, check nothing nasty slipped in first, and tidy up if it did.

Why this keeps getting more likely

Here's the bit that should really shape how you think about your website. The gap between "a flaw is announced" and "your site gets probed" used to be days or weeks. It's now hours.

Working attack code for wp2shell was public and being used almost immediately. That's the world we're in now: automated bots and AI-driven tools scan the entire internet around the clock, and the moment a weakness is published, they're already trying it on millions of sites at once. Your small business site isn't too small to bother with; to a bot, it's just another door to rattle, and it never gets tired or takes a day off.

This isn't a one-off. It's the direction of travel, and it's only getting faster.

What actually keeps a site safe

None of this is a reason to panic, and it's certainly not a reason to abandon WordPress; it's still a brilliant platform that I build on happily every week. It's a reason to make sure a real person is looking after it.

That's the bulk of what a maintenance retainer quietly buys you: someone who patches core, themes and plugins quickly when it matters; who hardens the site before there's a problem; who keeps an eye out for the signs something's wrong; and who's on hand to sort it fast if another 17 July comes around. Unglamorous, mostly invisible, and the difference between a non-event and a very bad week.

If you're not sure who's minding your WordPress site, or you suspect the honest answer is "no one," that's worth fixing before the next wp2shell rather than after. I build and look after WordPress sites for exactly this reason; you can see how I approach website design and development here, and if you'd like a straight answer on where your site stands, get in touch.

Go well!

‍