A serious WordPress flaw was patched on Friday. Check your site in two minutes.

What happened

On 17 July 2026, WordPress released emergency security updates — versions 6.8.6, 6.9.5 and 7.0.2 — fixing two flaws in WordPress itself (not in a plugin or theme). Security researchers have nicknamed the pair "wp2shell", and they are formally tracked as CVE-2026-63030 and CVE-2026-60137.

Chained together, the two flaws let a complete stranger — no login, no password, no interaction from you — send your website a request that ends with them running their own code on it. In practical terms, that's full takeover: they can read your database (customer details, order records, password data), plant a hidden backdoor called a webshell (a small file that gives them a permanent way back in), deface pages, or quietly use your site to attack others.

This one is unusual, and worth your attention, for three reasons. First, it's in WordPress core — the base software itself — so a perfectly maintained site with no plugins at all can still be affected. Second, security firm Patchstack reported the flaw being exploited in the wild on the same evening the fix came out, and working example attack code is now circulating publicly. Third, exploitation is automated: attackers feed lists of websites to scanning tools, so a small Australian business is exactly as likely to be probed as anyone else.

Is your site affected?

First, this only concerns sites built on WordPress. If your site runs on Shopify, Squarespace, Wix or another hosted platform, this particular issue isn't yours — you can stop reading (though the habit of checking still serves you well). If you're not sure what your site is built on, ask whoever built it; it's a one-line question.

For WordPress sites, it comes down to the version number:

A note on the middle rows: on versions 6.9.0–6.9.4 and 7.0.0–7.0.1, the two flaws chain together into full remote takeover. On 6.8.0–6.8.5 only the second flaw applies — a SQL injection, which means an attacker can trick your site's database into answering questions it should never answer. That can't be chained to full takeover on those versions, but an anonymous stranger reading your customer records and password data is serious on its own — and for an Australian business, losing personal information that way can be a notifiable data breach.

"My site updates itself" — why that's not proof

WordPress.org considered this severe enough to push forced automatic updates to affected sites. That's genuinely good — many sites were patched over the weekend without their owners lifting a finger.

But "the update was pushed" and "my site is updated" are not the same sentence. Auto-updates can fail quietly: some hosts and developers disable them, some sites have file permissions that block them, and a failed background update doesn't ring any bells. The honest advice — echoed by the researchers who analysed this flaw — is to verify the version number yourself rather than assume the machinery worked.

How to check — about two minutes

Why July has been a rough month for WordPress sites

This lands on top of an already busy month. On 9 July the Australian Cyber Security Centre issued a critical alert about a global campaign planting webshells on websites through out-of-date CMS plugins — explicitly noting that many small and medium Australian businesses have been affected. That campaign targets plugins; wp2shell is in WordPress core. Different doors, same house.

The takeaway isn't fear — it's a routine. Software updates are the single cheapest security control a small business has. Fifteen minutes a month checking your version numbers removes you from the lists that automated attacks are built on. We wrote a plain-English walkthrough of the ACSC alert if you want the plugin side of the story.

Where a scan fits in

One of the checks in every AegorIQ report — including the free Scorecard — looks at known software vulnerabilities: we identify what your site is running (WordPress core, plugins, themes, where they're publicly detectable) and check it against a live vulnerability feed. If your site is telling the whole internet it's running a version with a known flaw, that appears in your report in plain English, with what to do about it.

Being honest about the limits, as always: we check what's publicly visible from the outside. If your site doesn't reveal its version, we tell you the check couldn't complete rather than guessing — and a scan is a point-in-time review, not a substitute for the two-minute dashboard check above. For this week, do the dashboard check first. It's free, it's fast, and it answers today's question directly.