WordPress security vulnerability wp2shell — important information about your IONOS contract

Applies to WordPress.

On July 17, 2026, two vulnerabilities were patched in the widely used content management system, WordPress. A combination of these two vulnerabilities, also known as wp2shell, allowed malicious code to be injected and a WordPress installation to be compromised without the need for a login or user interaction. This Help Center article provides background information about the vulnerabilities, your options for checking for a potential compromise, and what steps to take next.

Affected WordPress versions

Exploitation of the vulnerabilities known as wp2shell was only possible in the following versions of WordPress:

• WordPress 6.8.x < 6.8.6 (affected by only one of the two vulnerabilities)
• WordPress 6.9.x < 6.9.5
• WordPress 7.0.x < 7.0.2
• WordPress 7.1 beta < 7.1 beta2

If your WordPress installation was running one of the versions listed above after July 17, 2026, or is still running one of them now, there is a risk that a successful attack has been carried out on your website.

Check the version of your WordPress installation

If you know your version number, you’ll know whether your WordPress installation is currently vulnerable or secure:

• Online check at wp2shell.com: Works without needing to log in to WordPress.
• WordPress Dashboard: To check your current version, log into your WordPress installation by following these steps:
  • Open your web browser and go to your WordPress login page (typically found by adding /wp-admin or /wp-login.php to the end of your website's URL, e.g., https://www.yourdomain.com/wp-admin
  • Enter your WordPress username or email address.
  • Enter your password.
  • Click the Log In button.

Please note: Even if you currently have a secure version of WordPress, this does not necessarily mean that it was updated in good time. You should therefore check for any signs of a successful wp2shell attack.

Why you need to take action regarding wp2shell

Malicious actors have automated the process of searching for WordPress installations that are vulnerable to wp2shell. This means that even lesser-known websites may be successfully attacked.

Once an attacker has gained access to your WordPress installation, they also have access to other information you hold, such as passwords, tokens, or API credentials.

Immediate measures following a successful wp2shell attack

• Plugin and application passwords stored in WordPress: Change all passwords in applications linked to your WordPress installation, such as online shops. Do not reconnect your WordPress to these applications until you are certain that your installation is free of wp2shell.
• WordPress database password: You must change the password for your MySQL or MariaDB database in your IONOS account and then adjust it in the wp-config.php file of your WordPress installation.
• Reused passwords: If you have reused a password in connection with your WordPress installation, it must be changed everywhere it is used. Please note: Reusing the same password poses a very high risk and should be avoided at all costs.
• IONOS customer password: To change the password for your IONOS account, after logging in, click on Menu > My account > Login & account security > Change password. Please also refer to the Help Center article Creating a secure password
• IONOS email passwords: The Help Center article Changing your IONOS email account password explains how to do this.

Where can I find further technical information?

You can find the technical details here: https://nvd.nist.gov/vuln/detail/CVE-2026-63030