Help Center
Home WordPress

WordPress security vulnerability wp2shell — important information about your IONOS contract

Valid for WordPress.

On July 17, 2026, two vulnerabilities were patched in the widely used content management system, WordPress. A combination of these two vulnerabilities, also known as wp2shell, allowed malicious code to be injected and a WordPress installation to be compromised without the need for a login or user interaction. This Help Center article provides background information about the vulnerabilities, your options for checking for a potential compromise, and what steps to take next.

Affected WordPress versions

Exploitation of the vulnerabilities known as wp2shell was only possible in the following versions of WordPress:

  • WordPress 6.8.x < 6.8.6 (affected by only one of the two vulnerabilities)
  • WordPress 6.9.x < 6.9.5
  • WordPress 7.0.x < 7.0.2
  • WordPress 7.1 beta < 7.1 beta2

If your WordPress installation was running one of the versions listed above after July 17, 2026, or is still running one of them now, there is a risk that a successful attack has been carried out on your website.

Check the version of your WordPress installation

If you know your version number, you’ll know whether your WordPress installation is currently vulnerable or secure:

  • Online check at wp2shell.com: Works without needing to log in to WordPress.
  • WordPress Dashboard: After logging into your WordPress installation, you will find the current version in the Dashboard.

Please note: Even if you currently have a secure version of WordPress, this does not necessarily mean that it was updated in good time. You should therefore check for any signs of a successful wp2shell attack.

Why you need to take action regarding wp2shell

Malicious actors have automated the process of searching for WordPress installations that are vulnerable to wp2shell. This means that even lesser-known websites may be successfully attacked.

Once an attacker has gained access to your WordPress installation, they also have access to other information you hold, such as passwords, tokens, or API credentials.

Immediate measures following a successful wp2shell attack

  • Plugin and application passwords stored in WordPress: Change all passwords in applications linked to your WordPress installation, such as online shops. Do not reconnect your WordPress to these applications until you are certain that your installation is free of wp2shell.
  • WordPress database password: You must change the password for your MySQL or MariaDB database in your IONOS account and then adjust it in the wp-config.php file of your WordPress installation.
  • IONOS customer password: To change the password for your IONOS account, after logging in, click on Menu > My account > Login & account security > Change password. Please also refer to the Help Center article Creating a secure password
  • IONOS email passwords: The Help Center article Changing your IONOS email account password explains how to do this.
  • Reused passwords: If you have reused a password in connection with your WordPress installation, it must be changed everywhere it is used. Please note: Reusing the same password poses a very high risk and should be avoided at all costs.
  • Salts (security keys): Renew the security keys (salts) in your wp-config.php file. This will immediately log out all currently logged-in users (and also potential attackers).

Security check and backup restoration

IONOS has carried out security checks in connection with the wp2shell threat and informs customers if specific indications of a compromise of files and/or databases have been found.

To ensure that there are no longer any compromised files on your website, IONOS recommends in such cases that you restore your data to the state it was in before the attacks (Saturday, July 18, 2026). 

What you need to do now: 

  • Log in to your IONOS account.
  • Give IONOS permission to restore a secure backup. 
  • After the successful update, enter your changed passwords and other access credentials such as API keys and tokens in your WordPress, and follow the recommendations from the previous section “Immediate measures following a successful wp2shell attack”.

What we will do for you: We will automatically restore your last secure backup, protect your WordPress against the security vulnerability again, and notify you by email as soon as this process has been completed. Alternatively, you can restore an existing backup yourself and secure it against the vulnerability.

Please note: We will make every effort to back up the current state of your database and restore it after recovery — however, we cannot guarantee that all data will be fully preserved. We therefore recommend that you export and back up important content yourself beforehand.

If you need further assistance, please contact IONOS Customer Support. 

Warning

If you are restoring your WordPress from a backup, it's possible that your restored WordPress installation may be in an unpatched, vulnerable version. It is imperative to update WordPress to the latest version immediately after restoring it.

Check your website for a successful wp2shell attack

The BSI (British Standards Institution) recommends the following steps for checking a WordPress website:

  • Look for POST requests related to /wp-json/batch/v1; in particular, an increased number of requests is suspicious.
  • Search for requests with ?rest_route=/batch/v1
  • Login attempts with wp2_* , w2s_*
  • Admin accounts associated with the email addresses @wp2shell.invalid, @wp2shell.shellcode.lol, or generally WordPress accounts that were not created by you.
  • Changes and anomalies in oembed_cache and customize_changeset
  • Additional new or modified files, plugins, and accounts, especially new administrator accounts.
  • The execution of unusual processes/shell commands on the web server.
  • Unusual outgoing connections.

For less technically inclined users, https://research.eye.security/wp2shell-defenders-guide/ offers a WordPress plugin for checking for a wp2shell infection.

You don’t manage your WordPress site yourself?

Please forward the link to this Help Center article immediately to your webmaster, IT department or the digital agency supporting you.

Where can I find more information?

You can find more information on the vulnerabilities in the National Vulnerability Database:

Improve the security of your WordPress installation

An important step to improve the security of your WordPress installation is to activate the built-in automatic update function via the dashboard:

  • WordPress core: Click on Dashboard > Updates within your WordPress admin dashboard.
    Some WordPress versions hosted on IONOS offer an update option on the project page. This page opens automatically when you navigate within your IONOS account from Menu > Web Projects and click on the tile with the desired WordPress site.
  • WordPress plugins: Click on Plugins > Installed Plugins within your WordPress admin dashboard. In the plugins overview, you can activate automatic updates in the last column.

Content