Everyone's telling you the same thing right now: update WordPress. Which is, fine, yes, obviously but that's not enough. Patching closes the hole. What is someone is already In your system?
So let's actually walk through this properly what to do right now, what to do if you can't patch immediately, and what to do if you think you were already hit.
Need more context? I wrote a summarising one here.
WordPress flipped on forced automatic background updates for this one because of how serious it is. That's great, except "forced" doesn't mean "guaranteed", VERIFY IT.
Go look at your actual running version right now:
wp-admin > Updateswp core versionYou want to see 7.0.2 if you're on the 7.0 line, or 6.9.5 if you're on 6.9.
If you see anything else — 6.9.0 through 6.9.4, or 7.0.0/7.0.1 — you're still exposed. Update it now!! Come back when done.
A few situations where the forced update quietly doesn't happen, in what I read on internet:
wp-config.php with WP_AUTO_UPDATE_CORE explicitly set to falseIf any of that describes you, don't wait on the automation. Update manually.
aybe you're facing a compatibility issue, a change freeze, or a custom plugin that isn't ready yet. It happens. If you need a little more time before applying the real fix, here's a workaround that helps.
Block anonymous access to the batch REST endpoint. The vulnerable surface is specifically /wp-json/batch/v1 and its query-string equivalent, ?rest_route=/batch/v1. You can handle this a couple of ways:
I want to be upfront about the tradeoff here: both of these can break legitimate things. The block editor uses REST endpoints. So do a lot of mobile apps and third-party integrations. This is a temporary bandage, not a real fix — treat it that way and get back to updating properly as soon as you can.
If you're behind Cloudflare, also check whether their managed ruleset for this specific vulnerability is switched on for your zone. They shipped detection rules pretty quickly after disclosure.
This is the part almost everyone skips, and it's the part that actually matters if your site was sitting in an affected version between when this became exploitable and when you patched.
Quick gut check on timeline: disclosure was July 17. In-the-wild exploitation was confirmed within days of that. So if your site was running 6.9.0-6.9.4 or 7.0.0-7.0.1 and internet-facing anytime after that, don't just assume nothing happened please go look.
Things worth checking:
Admin accounts. Anything new that you didn't create? Any password resets you didn't trigger? This is usually the first thing an attacker does once they've got code execution — plant a persistent admin account so they don't need the exploit again.
File timestamps. Look through wp-content, especially theme and plugin directories, for files modified around dates that don't line up with anything you actually did. A stray .php file with a weird name sitting in an upload directory is a classic sign.
Scheduled tasks. Check wp_cron for anything unfamiliar. Attackers sometimes use this for persistence.
Access logs. Search for anonymous POST requests hitting /wp-json/batch/v1 or ?rest_route=/batch/v1 around your exposure window. That's the fingerprint of someone probing or actually exploiting the chain.
Database. If you're comfortable poking around directly, check wp_users and wp_options for anything that looks off — unexpected serialized data, options keys you don't recognize.
If you find something genuinely anything from that list — this stops being a "patch and move on" situation. At that point:
None of this is wp2shell-specific, but it's exactly the kind of thing that determines whether the next core vulnerability catches you exposed or not:
Check your actual WordPress version, don't trust that the forced update ran. Get to 7.0.2, 6.9.5, or 6.8.6 depending on your branch. If you can't update immediately, block anonymous access to /wp-json/batch/v1 as a temporary measure. If your site was exposed anytime after July 17, go check for signs of compromise before you assume patching was the end of it. That's the whole job.
Based on public source from WordPress.org, and Cloudflare's reporting on wp2shell (CVE-2026-63030 / CVE-2026-60137), current as of late July 2026.
Ähnliche Beiträge
Thematisch verwandte Begriffe: Actually, Protect, Yourself, From · 6 Treffer
Videos werden geladen ...
Beiträge werden geladen ...
Videos werden geladen ...
Beiträge werden geladen ...
Videos werden geladen ...
Beiträge werden geladen ...
Videos werden geladen ...
Beiträge werden geladen ...
Videos werden geladen ...
Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.
Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.
SOCIAL SHARE CARD GENERATOR