Please use the “Print” function at the bottom of the page to create a PDF.
Applies to WordPress.
On July 17, 2026, two vulnerabilities were patched in the widely used content management system, WordPress. A combination of these two vulnerabilities, also known as wp2shell, allowed malicious code to be injected and a WordPress installation to be compromised without the need for a login or user interaction. This Help Centre article explains the background to this issue and what you should do.
Affected WordPress versions
Exploitation of the vulnerabilities known as wp2shell was only possible in the following versions of WordPress:
- WordPress 6.8.x < 6.8.6 (affected by only one of the two vulnerabilities)
- WordPress 6.9.x < 6.9.5
- WordPress 7.0.x < 7.0.2
- WordPress 7.1 beta < 7.1 beta2
If your WordPress installation was running one of the versions listed above after July 17, 2026, or is still running one of them now, there is a risk that a successful attack has been carried out on your website.
Check the version of your WordPress installation
If you know your version number, you’ll know whether your WordPress installation is currently vulnerable or secure:
- Online check at wp2shell.com: Works without needing to log in to WordPress.
- WordPress Dashboard: Once you’ve logged in to your WordPress installation, you’ll find the current version in the dashboard.
Please note: Even if you currently have a secure version of WordPress, this does not necessarily mean that it was updated in good time. You should therefore check for any signs of a successful wp2shell attack.
Why you need to take action regarding wp2shell
Malicious actors have automated the process of searching for WordPress installations that are vulnerable to wp2shell. This means that even lesser-known websites may be successfully attacked.
Once an attacker has gained access to your WordPress installation, they also have access to other information you hold, such as passwords, tokens, or API credentials.
Immediate measures following a successful wp2shell attack
- Plugin and application passwords stored in WordPress: Change all passwords in applications linked to your WordPress installation, such as online shops. Do not reconnect your WordPress to these applications until you are certain that your installation is free of wp2shell.
- Reused passwords: If you have reused a password in connection with your WordPress installation, it must be changed everywhere it is used. Please note: Reusing the same password poses a very high risk and should be avoided at all costs.
- IONOS customer password: To change the password for your IONOS account, after logging in, click on Menu > My account > Login & account security > Change password. Please also refer to the Help Centre article Creating a secure password
- IONOS email passwords: The Help Centre article Changing your IONOS email account password explains how to do this.
Where can I find further technical information?
You can find the technical details here: https://digital.nhs.uk/cyber-alerts/2026/cc-4815