Security guideWordPressJuly 2026

WordPress WP2Shell (July 2026): version checks and safe recovery

On 17 July 2026, WordPress issued an urgent security release for two core issues that could be chained into unauthenticated remote code execution. This incident involved WordPress core, not merely an optional plugin.

Published WordPress core advisories give you a concrete version check. Confirm the installed release while the site is still accessible, then plan the appropriate update.

Reviewed 26 October 2026 · Evidence-based guidance for site owners, not a remotely confirmed diagnosis.

Which WordPress releases require review

The July disclosures include CVE-2026-63030 (REST API batch-route confusion) and CVE-2026-60137 (SQL injection). WordPress 7.0.0–7.0.1 and 6.9.0–6.9.4 were affected by both. The fixes arrived in 7.0.2 and 6.9.5. The 6.8 branch was affected by the separate SQL injection flaw and received 6.8.6; WordPress.org reported older branches prior to 6.8 were not affected by these particular July issues.

These are minimum security-fix points for the July incident, not recommendations to stay on an older release indefinitely. Install the current supported security release for your branch.

How to verify the update and possible impact

  1. Record the current WordPress core version in Dashboard → Updates or through an authorized WP-CLI inventory. Do not rely solely on the version exposed in public HTML.
  2. Confirm that background updates ran successfully. WordPress enabled forced automatic updates for affected installations, but owners should verify completion and look for update failures.
  3. Preserve backups and logs before changes. Review unexpected privileged accounts, newly modified PHP files, unknown active plugins, scheduled tasks and suspicious outbound requests in the affected period.
  4. Update to an appropriate current maintained release, then review that login, content, forms and checkout still work. Remove any verified malicious persistence only through a controlled incident response.

Why the latest scanner result cannot certify safety

A VirusTotal reputation result of zero detections does not rule out a core vulnerability. The checker can use publicly revealed WordPress versions to identify potential exposure, but hidden versions, vendor backports and compromised files require authorized review. Do not copy attack payloads into a live website to prove susceptibility.

Primary sources and patch references

Verify the latest release and vendor-specific backports before taking action. This guide records information available as of 26 October 2026.

WordPress.org — WordPress 7.0.2 security releaseWordPress.org — Version 7.0.2 and affected branchesCloudflare — WAF protections and WordPress advisories

Related security guides

PHP2Shell: verify and patch the October 2026 PHP vulnerabilitiesWordPress September 2026 file-inclusion flaw: what to checkJoomla JCE 2026 vulnerability: version and compromise checklistEU 2026 cybersecurity rules: are CMS updates mandatory?

Need a second opinion?

Start with a free public website check or describe the concern. Do not send credentials, raw customer data or full private logs. Any technical work beyond the free enquiry requires an agreed scope.

Run free website check Request free scope enquiry