← Înapoi la articole

Do you have a WordPress website? Check and update it today.

19 July 2026 Alpar Torok
Do you have a WordPress website? Check and update it today.

WordPress security alert: check and update your website

If you have a WordPress website, now is a good time to check what version is running and if the security updates have been installed.

The National Cyber Security Directorate (DNSC) has drawn attention to the vulnerabilities known as wp2shell, which affect WordPress Core. We are not talking about an obscure plugin or an abandoned theme, but about vulnerabilities located directly in the WordPress core.

The problem is all the more important since technical information and public exploit code already exist for these vulnerabilities, and exploitation attempts have been observed in practice.

What is wp2shell?

wp2shell is the name used for a chain consisting of two security vulnerabilities in WordPress Core.

  • CVE-2026-63030 affects how certain requests to the WordPress REST API can be processed.
  • CVE-2026-60137 is an SQL Injection type vulnerability in WordPress Core.

In certain WordPress versions, the two vulnerabilities can be combined to allow an unauthenticated attacker to execute code on the server.

In other words, the attacker does not necessarily need a WordPress account or a vulnerable plugin to try to exploit the problem.

Which WordPress versions were affected?

The wp2shell vulnerabilities do not affect all WordPress versions in exactly the same way.

  • WordPress 6.8.0 to 6.8.5 was affected by the SQL Injection vulnerability.
  • WordPress 6.9.0 to 6.9.4 was affected by the entire chain that could lead to code execution.
  • WordPress 7.0.0 and 7.0.1 were also affected by the full chain.

The wp2shell problems were initially fixed in WordPress 6.8.6, 6.9.5, and 7.0.2.

But this does not mean the current recommendation is to update only to one of these versions.

WordPress 7.0.4 is already available

At the time of publishing this article, the newest stable WordPress version is WordPress 7.0.4, released on August 12, 2026.

And this is a security version. WordPress recommends administrators update their websites immediately.

Therefore, our recommendation is simple:

Don't just check if you installed the wp2shell patch. Check if your website is running the newest stable WordPress version available and compatible with your configuration.

What do you need to do if you have a WordPress website?

1. Make a complete backup

Before any major update, make a complete backup of the website.

The backup should include at least:

  • the WordPress files;
  • the database;
  • the uploads folder;
  • the theme used;
  • the plugins and important configurations.

Ideally, the backup should be kept in a separate location from the website server.

2. Check the WordPress version

In most installations you can check the version from:

Dashboard → Updates

If there is a new version, WordPress will show you the update option.

3. Update WordPress Core

If the website allows the update without compatibility problems, update WordPress to the newest stable version available.

Do not automatically assume the update was installed just because you enabled automatic updates. Check the version that is actually running.

4. Update the plugins and theme

Updating WordPress Core is only one part of maintaining a website.

Also check:

  • the installed plugins;
  • the active theme;
  • the inactive themes that are still installed;
  • the inactive plugins;
  • the PHP version used by the hosting.

Abandoned plugins or themes still pose a risk even if WordPress Core is updated.

5. Do not blindly update a critical website

Here comes an important difference between a simple update and properly done maintenance.

If we are talking about a simple presentation website, the update can be very fast.

However, if we are talking about an online store, a website with many plugins, integrations, forms, booking systems, or custom developments, the recommendation is to make a backup first and, where possible, test the update.

A security update is important. But a completely blocked website after an update done without checking is not a good result either.

If the website was vulnerable, updating is not always enough

This is a point that is frequently lost in "update WordPress" type messages.

If a website was compromised before installing the patch, updating WordPress does not automatically remove what the attacker might have already introduced on the server.

For websites that have run a vulnerable version for a longer period, it is worth checking at least:

  • if unknown administrator users have appeared;
  • if there are new or inexplicably modified PHP files;
  • if the installed plugins match the known ones;
  • if there are suspicious modifications in the theme files;
  • the server's access logs;
  • any redirects or unknown JavaScript code;
  • unusual cron tasks or processes.

WordPress is not insecure because vulnerabilities appear

The fact that WordPress receives security updates does not mean the platform is automatically insecure.

Any complex software can have vulnerabilities. The important difference is how quickly the problems are identified, how quickly the patches appear, and, most importantly, how quickly they are installed.

The problem we frequently see is not WordPress itself, but websites that have not been updated for months or even years.

On such sites we often find the classic combination:

  • old WordPress;
  • outdated plugins;
  • plugins that are not even used anymore;
  • abandoned themes;
  • old PHP versions;
  • non-existent or unverified backups.

This turns a problem that could be solved by regular maintenance into a much more complicated security incident.

Do you need help with your WordPress website?

In the Dalbe Digital Agency team, the WordPress part is coordinated by Dalma, who has been working with the platform for over 10 years.

We can help with:

  • backup before updating;
  • updating WordPress Core;
  • updating and checking plugins;
  • updating the theme;
  • technical checks after the update;
  • identifying suspicious files or accounts;
  • regular maintenance for WordPress websites.

If you are not sure what WordPress version your website is running or if the update can be done safely, you can write to us before modifying anything.

Dalbe Digital Agency
Târgu Mureș
office@dalbe.ro
0725 571 731

Sources

The technical information in this article is based on the DNSC alert, information published by the WordPress project, and technical analyses published after the wp2shell vulnerabilities appeared.