When the wp2shell flaws were disclosed in July, sites on WordPress.com, Pressable, WPVIP and WP.cloud were already protected, according to Automattic. Self-hosted sites that did not update automatically carried the most risk. On September 22, another critical core flaw, CVE-2026-87902, was fixed in WordPress 7.1.2 and exploited the same day. This guide explains who was exposed and gives you seven questions to put to your own host.
What wp2shell was
Two critical flaws, CVE-2026-60137 (an SQL injection) and CVE-2026-63030 (arbitrary code execution), could be chained to run code on a WordPress server without logging in. Searchlight Cyber reported that they affect WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, even on a standard install with no plugins. WordPress released fixes in versions 6.9.5 and 7.0.2.
Security firms reported the first attacks within hours of disclosure. Techzine reported that more than 400 million sites ran a vulnerable version when the updates were released. An estimate based on a sample of about 3,500 sites suggested that fewer than 15 percent remained vulnerable afterwards, which TechCrunch put at roughly 90 million sites.
The September 22 flaw
CVE-2026-87902 is a critical flaw in how WordPress core resolves page templates. Reports citing the WordPress.org announcement say it affects releases from 4.7.0 through 7.1.1 unless a security backport is applied, and that fixes shipped in 7.1.2 and in backports such as 7.0.6 and 6.9.9. Patchstack reported the first exploitation attempt on the day of the release. Our 7.1.2 security update checklist covers what to verify.
Who was protected
| Where the site runs | Who patches | What to confirm |
|---|---|---|
| WordPress.com, Pressable, WPVIP, WP.cloud | The platform. Automattic told TechCrunch these were protected before the wp2shell patches were public. | Check each platform's own notices for the September flaw. |
| Another managed WordPress host | Depends on the host. The sources we read do not cover them. | Ask the seven questions below and get the answers in writing. |
| Shared hosting or your own server | You, unless automatic updates are on | Your core version and whether automatic updates are enabled |
| Managed by an agency or freelancer | Whoever your agreement names | Their patch policy and the date they applied each security release |
Automattic's statement covers its own platforms. Do not assume the same for every host that calls itself managed.
Seven questions to ask your host
- Do you apply WordPress core security updates automatically, and how soon after release?
- On which date did you apply the latest security release to my site? Can you show the log?
- Do you run a web application firewall or virtual patching in front of my site, and was a rule active before I updated?
- Do you update plugins and themes, or only core?
- Where can I see my site's version history and update log?
- What happens if an automatic update breaks my site? Is there a rollback?
- Who tells me about a critical advisory, and how quickly?
Check your own site in two minutes
If you have WP-CLI access:
wp core version
wp core check-update
Otherwise open Dashboard, then Updates, in wp-admin. Compare the version with the fixed releases for your branch in the WordPress.org announcements. Anything below the fixed version for its branch was behind on that release.
If your site ran an affected version
Treat it as possibly compromised until you have checked. Look for new administrator accounts, changed core files and PHP files in the uploads folder. Our patch-window guide lists the commands, and if anything looks wrong our emergency hacked-site recovery service can help you contain the problem and clean it up.
Frequently asked questions
Does managed hosting mean I never have to update?
No. Managed hosts differ in what they update and how fast. Ask the questions above and keep the answers.
Were WordPress.com sites affected by wp2shell?
Automattic told TechCrunch that sites on WordPress.com, Pressable, WPVIP and WP.cloud were protected before the patches were public.
Which WordPress versions fixed wp2shell?
Versions 6.9.5 and 7.0.2 carried the fixes, according to Techzine's report. Confirm in the official WordPress release notes.
Not sure what your host really covers?
We check hosting, update settings and patch history, then put a written patch policy in place. See our WordPress maintenance service.
