If you manage WordPress sites for clients or run your own, give this five minutes today. A serious WordPress security vulnerability, now being called wp2shell, lets attackers break into a WordPress site and create their own admin account without needing a password, a login, or any user action at all. It’s been actively exploited since mid-July 2026, and the fix is simple, but you do need to check for it.
What this WordPress security vulnerability actually does?
Two bugs in WordPress Core, when combined, let an attacker send a specially crafted request to your site and walk away with a working administrator account. No phishing, no guessed password, no plugin vulnerability involved. Only WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected. If you’re on 6.8.5 or earlier, or already updated past those ranges, this specific issue doesn’t apply to you.
What to do right now (don’t skip this part)
- Check your WordPress version. If it falls in 6.9.0–6.9.4 or 7.0.0–7.0.1, update to 6.9.5 or 7.0.2 immediately. This is the single most important step.
- Open your Users list and look for any admin account you don’t recognize. This is the big one — more on why below.
- Check
wp-content/plugins/for any plugin you or your client didn’t install. - Peek inside
wp-content/for stray.phpfiles that don’t belong to any plugin or theme you know of.
If you manage several client sites, this is worth doing on all of them today rather than waiting for something to break.
Why a “did it work or not” attack still leaves a clue
Here’s the part that makes this worth understanding, not just patching. Security researchers found a case where the attack ran on the same server three times before it fully succeeded. The first two attempts created a rogue admin account and then just… stopped. No further damage. Only the third attempt went all the way and let the attacker install malicious plugins and gain full control.
Why does that matter for you? Because even a failed or half-finished attack leaves a rogue admin account behind. The cleanup step in the attacker’s script only runs when the whole thing succeeds. So the normal instinct — “nothing looks broken, we’re probably fine” — doesn’t hold here. An unfamiliar admin account is a red flag on its own, even if nothing else on the site looks wrong. If you find one, treat the site as targeted and dig further before assuming it’s fine.
How the attack actually works
If you’re curious about the mechanics: WordPress has a REST API “batch” feature that lets multiple requests get bundled into one call. A flaw in how it checks that request lets an attacker sneak a request past WordPress’s normal login checks entirely. From there, a second bug — a database query flaw — lets that unchecked request quietly plant a working admin account in the site’s settings. Two ordinary WordPress features get misused as the delivery mechanism, and the result is a working login with zero credentials guessed or stolen.
You don’t need to memorize the mechanics to protect yourself — patching to the latest version closes the door completely. This section is just here if you want to understand what you’re actually defending against.
If you can’t patch immediately
Sometimes a client site is on a custom setup and you’re nervous about updating without testing first. If that’s you, the temporary workaround is blocking public access to /wp-json/batch/v1 at your server or firewall level until you can update safely. It’s a stopgap, not a fix — patch as soon as you can.
The bigger takeaway
This is a good nudge for anyone doing WordPress maintenance work: a site running fine today can still be sitting on an unpatched vulnerability quietly waiting to be found. Adding a quick “check core version + check admin users” step to your client site audits costs a few minutes and can catch exactly this kind of silent compromise before it turns into a 2am emergency call.
Managing WordPress or WooCommerce sites for clients? A quick version and admin-user check takes minutes and can save you from inheriting a compromised site. If you’re not sure how to check any of the above, drop a comment or reach out.