WordPress 'wp2shell' Flaw: What Small Businesses Need to Check

WordPress recently addressed a critical security issue known as 'wp2shell' that affects the core software itself—not just plugins. This flaw allows an unauthenticated attacker to take over a site, making it important for anyone running a public WordPress website to confirm their site is protected and check for any signs of compromise.

Why This Matters to Small Businesses and Nonprofits

Many small businesses and nonprofits rely on WordPress for their public websites. This vulnerability does not affect Microsoft 365 or internal systems, but it does put your website at risk of takeover if left unpatched. Attackers have been observed dropping persistent webshells and creating rogue administrator accounts, which can lead to loss of control and reputational harm.

Understanding the 'wp2shell' Flaw

The 'wp2shell' chain combines two vulnerabilities in WordPress Core: a REST API batch-route confusion and a SQL injection. Together, they let an unauthenticated attacker run code on a stock WordPress site. Public proof-of-concept exploits are available, and in-the-wild attacks have been reported. WordPress released patches in versions 7.0.2, 6.9.5, and 6.8.6. Automatic updates were enabled, but not every site receives them immediately or successfully.

Recommended Steps: How to Confirm Your Site Is Safe

• Check Your WordPress Version: Log in to your WordPress dashboard and look for the version number at the bottom or in the 'Updates' section. Your site should be running 7.0.2, 6.9.5, or 6.8.6 (depending on your branch).
• Review Recent Admin Accounts: Go to 'Users' and review all administrator accounts. Remove any you do not recognize.
• Scan for Unexpected Files: Check your site's file manager for unfamiliar files, especially in the root directory or 'wp-content' folder. Webshells often appear as oddly named PHP files.
• Change Passwords: If you suspect compromise, change all admin passwords and enable multi-factor authentication (MFA) where possible.
• Review Site Activity: Look for unusual logins or changes in your site's activity logs. Many hosts provide access to these logs.

How NIS Helps Manage the Risk

NIS assists small businesses and nonprofits in keeping their WordPress sites secure and up to date. We verify that patches are applied, review your site for signs of compromise, and help you implement best practices like strong passwords and multi-factor authentication (MFA). If your site needs attention, our team provides calm, practical support to ensure you stay protected.

Closing Thoughts

While this vulnerability is serious, a few simple steps can help you confirm your site is safe and reduce risk moving forward. If you are unsure about your site's status or need help reviewing for signs of compromise, NIS is here to support your organization with steady, professional guidance.