Wordfence: WordPress's WP2Shell Attack Has Now Topped 11 Million Attempts

WPWithin has covered this flaw twice already: when WordPress 7.0.2 shipped the emergency fix on July 17, and again last week when Patchstack logged over 65,000 exploitation attempts in the days after. Security firm Wordfence has now published its own attack data, and the number is far bigger: its firewall has blocked more than 11 million attempts to exploit the same bug.

What the bug is, again

Researchers nicknamed the flaw WP2Shell. It chains two vulnerabilities together. An unauthenticated SQL injection bug, CVE-2026-60137, affects WordPress 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1. A separate REST API mix-up, CVE-2026-63030, affects only the 6.9 and 7.0 version ranges, but it lets an attacker escalate that SQL injection into creating a full administrator account with no login required. From there, an attacker can upload a plugin file that runs their own code on your server.

Why 11 million is not as scary as it sounds

Wordfence says its 11 million figure comes only from customers on its premium firewall rule, a small slice of its overall user base. That is why the count is so much higher than Patchstack’s number: the two firms are measuring traffic through different sets of sensors, not conflicting realities. More attempts got counted because more sensors were watching.

More importantly, WordPress’s Security Team pushed the fix as a forced automatic update on July 17, the kind of update every WordPress site receives regardless of your own update settings. Wordfence says that because the bug touched a narrow band of versions and the patch went out automatically to nearly everyone, it expects the large majority of sites are no longer vulnerable. A high attack volume, in other words, does not mean a wave of new break-ins.

What to do

Confirm your site reads 7.0.2, 6.9.5, or 6.8.6 under Updates in your WordPress dashboard. If you manage several sites, check each one individually, since a host-wide update does not always reach every install. If your site ran a vulnerable version for any stretch of time, look through your admin users for accounts you don’t recognize, and check your plugins folder for files you didn’t install.

End of article