WordPress Flaw Lets Hackers Plant Backdoors on Your Site

Robert Moore · 2026-07-21

If you run a WordPress site, you need to hear about this. Hackers are actively exploiting a pair of critical vulnerabilities in WordPress Core, collectively known as "wp2shell." These aren't just minor bugs. They're a full-blown attack suite that lets bad actors drop persistent webshells onto your server and install malicious plugins without your permission. It's serious, and it's happening right now. Think of a webshell as a secret backdoor into your website. Once it's in place, attackers can do pretty much anything. They can steal data, deface your site, use your server to launch attacks on others, or just sit quietly and wait for the right moment to cause chaos. The worst part? These backdoors are designed to be persistent, meaning they survive regular updates and even some security scans. ### How the Attack Works The wp2shell suite consists of two main vulnerabilities: CVE-2026-63030 and CVE-2026-60137. Together, they allow an attacker to bypass normal authentication checks. Once they get in, they can upload files directly to your server, including malicious PHP scripts that act as webshells. From there, they can install any plugin they want, even ones that look legitimate but have hidden malicious code. Here's a quick breakdown of what makes this attack so dangerous: - **No user interaction needed:** The attacker doesn't need you to click a link or download a file. - **Bypasses standard protections:** Many firewalls and security plugins won't catch this attack. - **Persistent access:** Even if you remove the initial webshell, attackers often leave multiple backup access points. ### What You Should Do Right Now The most important step is to update your WordPress installation as soon as a patch is available. Keep an eye on the official WordPress security announcements. If you're using a managed hosting provider, they might apply patches automatically, but don't rely on that. Check your version and update manually if needed. You should also: - Scan your site for unknown files, especially in the wp-content/uploads directory. - Review your installed plugins regularly. Remove anything you don't recognize or need. - Change all admin passwords and enable two-factor authentication. - Check your server logs for unusual activity, like unexpected file uploads or strange admin logins. ### Why This Matters for Your Business If you're running an online store, a membership site, or any site that handles user data, a webshell infection can be catastrophic. Attackers can steal customer payment information, email addresses, and other sensitive data. The damage goes beyond just your site. It can hurt your reputation and lead to legal trouble if you're not careful. And here's the thing: even if you think your site is too small to be a target, automated bots scan the web constantly for these vulnerabilities. They don't care who you are. They just find the hole and exploit it. ### Staying Ahead of the Threat Security isn't a one-time fix. It's an ongoing process. Besides keeping WordPress updated, consider using a web application firewall (WAF) that specifically blocks known vulnerability patterns. Also, limit file upload permissions to only what's absolutely necessary. If your site doesn't need to allow file uploads from users, disable that feature entirely. Another good practice is to use a security plugin that monitors file integrity. These tools can alert you when critical files change, which is often the first sign of an attack. ### The Bottom Line The wp2shell vulnerabilities are a wake-up call. They show that even core WordPress features can have dangerous flaws. Don't wait until your site gets compromised. Act now, update your software, and tighten your security practices. A little effort today can save you a massive headache tomorrow. Stay safe out there.