wp2shell Exposure Check.
Check whether a WordPress site is exposed to the wp2shell remote code execution flaw (CVE-2026-63030 and CVE-2026-60137).
Passive check. Reads only the public version, never sends an exploit.
About The wp2shell Vulnerability.
Unauthenticated Remote Code Execution
wp2shell chains a route-confusion bypass (CVE-2026-63030) with a SQL injection (CVE-2026-60137) to run code on a stock WordPress site, with no login required.
WordPress Core, Not A Plugin
The flaw lives in WordPress core itself, so a default install with no plugins is affected. Versions 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are exposed.
Fixed In 6.9.5 And 7.0.2
Updating to 6.9.5, 7.0.2, or later closes the exposure. Sites on 6.8.x and earlier were never affected by this vulnerability.
Passive By Design
This tool only reads the target's public version, the same information a browser sees. It never sends an exploit request or touches your data.
How The Check Works.
- 01
Enter A Domain Or URL
Type the WordPress site you want to check (e.g. yourcompany.com).
- 02
Run The Check
The tool reads the site's public version and compares it against the wp2shell affected range instantly.
- 03
Read The Verdict
See whether the site is exposed, already patched, or needs a closer look, with clear next steps.
FAQ
Common Questions.
wp2shell is the nickname for two chained WordPress core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, that together let an unauthenticated attacker run code on an affected site. It affects a stock install with no plugins.
Versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are exposed. The fixes shipped in 6.9.5 and 7.0.2. Sites on 6.8.x and earlier were not affected by this specific flaw.
No. The check is passive: it reads only the public version string from the readme and homepage, the same information any visitor's browser can see. It never sends an exploit payload or modifies anything.
The site looks like WordPress but its version could not be read, often because the readme was removed or a plugin hides the version. Confirm your version in the WordPress admin dashboard and update if it falls in the affected range.
Update WordPress to 7.0.2 or 6.9.5 (or later) as soon as possible. For continuous coverage beyond a single CVE, request a demo with the Brandefense team.
One CVE Checked. Thousands More Watched.
This tool checks a single vulnerability. The Brandefense platform monitors your entire external attack surface around the clock, and acts on what it finds.
Request A Demo