WordPress security: updates, checks and protection against wp2shell.
WordPress is the most widely used website system and therefore the most frequent target. Since July 2026 the wp2shell vulnerability in the WordPress core has been actively exploited, without any plugin. We check your installation, update the core, plugins and themes, remove legacy items and secure access.
What we do for your WordPress website
One-off as a security check or ongoing as maintenance.
- Security check: WordPress version, plugins, themes, users and permissions
- Updates first in a test copy, then on the live site
- Removal of unused or no longer maintained plugins and themes
- Securing admin access: two-factor login, protection against password guessing, clean role assignment
- Hardening: file permissions, no PHP execution in the upload folder, restricting unneeded interfaces
- Searching for traces of wp2shell: unknown administrators, unknown plugins, modified files
- Check and update the server's PHP version (PHP2Shell)
wp2shell: the key facts
| Vulnerabilities | CVE-2026-63030 (CVSS 9.8) and CVE-2026-60137, together known as wp2shell |
| Consequence | Execution of program code without logging in, in the WordPress core, with no plugin required |
| Affected | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2; the SQL injection also 6.8.x before 6.8.6 |
| Fixed in | WordPress 6.8.6, 6.9.5 and 7.0.2 |
| Situation | Actively exploited since July 2026: new administrator accounts, malicious plugins, web shells, reading of credentials from wp-config.php |
As of 23 October 2026. Source: Greenbone. In addition, PHP2Shell affects all WordPress websites with an outdated PHP version.
Prices and scope of services
Guide prices net, plus statutory VAT. The fixed price in our written quote is binding.
| WordPress security check with updates and hardening Check core, plugins, themes and users, updates in a test copy, hardening | €190–490 |
| Clean-up after an attack Remove unknown administrators, malicious plugins and web shells, renew access credentials | €150–600 |
| WordPress maintenance (website care) Ongoing updates, backup, monitoring, audit report | from €99 / month |
Why this matters
Our approach
- CheckVersions, extensions, users.
- Back upFull backup before every change.
- UpdateIn the test copy, then live.
- HardenSecure access and server.
- MaintainOngoing, with an audit report.
Frequently asked questions
I hardly use any plugins. Am I still affected?
Yes, if your WordPress version is affected. wp2shell sits in the WordPress core itself. What matters is whether your installation is at least on 6.8.6, 6.9.5 or 7.0.2.
Are WordPress's automatic updates enough?
Not always. Automatic updates are often switched off or fail unnoticed, and plugins and themes are frequently not updated automatically at all. In addition, an update does not remove a backdoor that was planted beforehand.
Which security plugin do you recommend?
A security plugin can help, but it replaces neither updates nor a clean configuration. We rely on a few well-maintained extensions and on hardening the server and WordPress.
What does WordPress maintenance cost?
Ongoing website care with updates, backups and an audit report costs from €99 / month. The one-off WordPress security check with updates and hardening costs €190–490 net.
Have your WordPress checked
Tell us the address of your WordPress website. We will get back to you with an assessment and a fixed price.
By phone: 030 417 17370
Briefly describe what you have in mind. We will get back to you with a concrete assessment.
Danziger Straße 78a
10405 Berlin
Berlin-Prenzlauer Berg