What Is wp2shell, and Should You Be Worried?

In July 2026, security researchers raised the alarm about a WordPress attack nicknamed "wp2shell." Within days, automated bots were scanning the internet and hitting tens of thousands of websites. If you run a WordPress site and you have seen the name pop up, here is what it actually means, in plain English, and whether you need to do anything about it.

The short version

wp2shell is a way for attackers to take over a WordPress website without needing a username or password. It chains together two flaws in unpatched versions of WordPress (tracked as CVE-2026-63030 and CVE-2026-60137) to slip a hidden file onto the site. That file is called a "web shell," and it quietly hands the attacker the keys to the whole website.

What is a "web shell," in normal words?

Think of a web shell as a secret back door. Once it is installed, an attacker can come and go whenever they like, without ever touching your login page. From there they can read your data, create fake admin accounts, send spam, inject scam links, redirect your visitors to dodgy sites, or quietly use your server to attack others. To make things trickier, some versions of the wp2shell back door disguise themselves as a legitimate "security" plugin, so a quick glance at the dashboard looks perfectly normal.

So, should you be worried?

For most people the honest answer is: only if your site is not kept up to date. The flaw lives in specific WordPress versions, and WordPress released a fix quickly. Updating to 6.9.5, 7.0.2 or later closes the hole completely. The sites getting hit are the ones running old, unpatched software. Outdated, unmaintained, and "set and forget" WordPress sites are the easy targets. If your site is patched and actively maintained, you are protected.

Every Bang Media client is on the latest, patched version of WordPress, so their sites are not exposed to wp2shell.

Signs your site may be compromised

• Admin users you do not recognise
• Plugins you never installed, especially odd "security" ones
• The site suddenly loading slowly, or redirecting visitors to strange pages
• Google or your browser flagging the site as "deceptive" or "not secure"
• Spammy pages or links showing up in search results for your domain
• Unexpected file changes, or a spike in server usage

None of these on their own prove an infection, but if you notice a few together, it is worth looking closer.

What to do about it

1. Update first. Make sure WordPress core, plugins and themes are all current (6.9.5 or 7.0.2 and up for this issue).
2. Take stock. Remove plugins and themes you do not use. Every extra one is another possible door.
3. Scan the site. A reputable security plugin, or your host, can scan for known web shells and malware.
4. Clean up. Delete any unknown admin users and suspicious files. If in doubt, restore from a backup taken before the infection.
5. Reset the locks. Change every password (admin, hosting, database, FTP) and rotate your security keys.
6. Get a second opinion. Web shells are built to hide. If you are not certain the site is clean, have a professional confirm it.

How to stop it happening again

• Keep WordPress, plugins and themes updated on a schedule
• Remove anything you are not actively using
• Put a firewall or security plugin in front of the site
• Take regular off-site backups
• Consider managed hosting or a maintenance plan so updates never slip through the cracks

How Bang Media can help

Keeping a WordPress site secure is not a one-off job, it is ongoing maintenance. We keep our clients' sites on the latest versions, watch for problems, and step in quickly when something looks off.

If you are concerned your site might be infected with wp2shell, or anything else, reach out and we can investigate for you. We will check the site over, tell you plainly where you stand, and clean it up if needed.

Get in touch and we'll take a look.