Help Center
Home WordPress

WordPress security vulnerability wp2shell — important information about your IONOS contract

Applies to WordPress.

On July 17, 2026, two vulnerabilities were patched in the widely used content management system, WordPress. A combination of these two vulnerabilities, also known as wp2shell, allowed malicious code to be injected and a WordPress installation to be compromised without the need for a login or user interaction. This Help Center article provides background information about the vulnerabilities, your options for checking for a potential compromise, and what steps to take next.

Affected WordPress versions

Exploitation of the vulnerabilities known as wp2shell was only possible in the following versions of WordPress:

  • WordPress 6.8.x < 6.8.6 (affected by only one of the two vulnerabilities)
  • WordPress 6.9.x < 6.9.5
  • WordPress 7.0.x < 7.0.2
  • WordPress 7.1 beta < 7.1 beta2

If your WordPress installation was running one of the versions listed above after July 17, 2026, or is still running one of them now, there is a risk that a successful attack has been carried out on your website.

Check the version of your WordPress installation

If you know your version number, you’ll know whether your WordPress installation is currently vulnerable or secure:

  • Online check at wp2shell.com: Works without needing to log in to WordPress.
  • WordPress Dashboard: To check your current version, log into your WordPress installation by following these steps:
    • Open your web browser and go to your WordPress login page (typically found by adding /wp-admin or /wp-login.php to the end of your website's URL, e.g., https://www.yourdomain.com/wp-admin
    • Enter your WordPress username or email address.
    • Enter your password.
    • Click the Log In button.

Please note: Even if you currently have a secure version of WordPress, this does not necessarily mean that it was updated in good time. You should therefore check for any signs of a successful wp2shell attack.

Note

IONOS customers with Managed Hosting for WordPress had the updates installed automatically.

Why you need to take action regarding wp2shell

Malicious actors have automated the process of searching for WordPress installations that are vulnerable to wp2shell. This means that even lesser-known websites may be successfully attacked.

Once an attacker has gained access to your WordPress installation, they also have access to other information you hold, such as passwords, tokens, or API credentials.

Immediate measures following a successful wp2shell attack

  • Plugin and application passwords stored in WordPress: Change all passwords in applications linked to your WordPress installation, such as online shops. Do not reconnect your WordPress to these applications until you are certain that your installation is free of wp2shell.
  • WordPress database password: You must change the password for your MySQL or MariaDB database in your IONOS account and then adjust it in the wp-config.php file of your WordPress installation.
  • IONOS customer password: To change the password for your IONOS account, after logging in, click on Menu > My account > Login & account security > Change password. Please also refer to the Help Center article Creating a secure password
  • IONOS email passwords: The Help Center article Changing your IONOS email account password explains how to do this.
  • Reused passwords: If you have reused a password in connection with your WordPress installation, it must be changed everywhere it is used. Please note: Reusing the same password poses a very high risk and should be avoided at all costs.
  • Salts (security keys): Renew the security keys (salts) in your wp-config.php file. This will immediately log out all currently logged-in users (and also potential attackers).

Security check and backup restoration

In your IONOS account, you can give your consent to restore a backup from Thursday, July 16, 2026, provided that IONOS has detected any anomalies. This ensures that there are no longer any compromised files in your webspace. After logging in to your IONOS account, you will receive a corresponding notification that you must confirm. For legal reasons, IONOS can only restore the backup with your consent.

Please note: All changes to your WordPress installation since the backup was created will be lost. You will be informed once the backup restoration has been completed. At that point, your original WordPress password will also be restored. After the restoration, immediately carry out the recommendations from the previous paragraph “Immediate measures after a successful wp2shell attack”.

If you need further assistance, please contact IONOS Customer Support. 

Warning

If you are restoring your WordPress from a backup, it's possible that your restored WordPress installation may be in an unpatched, vulnerable version. It is imperative to update WordPress to the latest version immediately after restoring it.

Check your website for a successful wp2shell attack

The BSI (British Standards Institution) recommends the following steps for checking a WordPress website:

  • Look for POST requests related to /wp-json/batch/v1; in particular, an increased number of requests is suspicious.
  • Search for requests with ?rest_route=/batch/v1
  • Login attempts with wp2_* , w2s_*
  • Admin accounts associated with the email addresses @wp2shell.invalid, @wp2shell.shellcode.lol, or generally WordPress accounts that were not created by you.
  • Changes and anomalies in oembed_cache and customize_changeset
  • Additional new or modified files, plugins, and accounts, especially new administrator accounts.
  • The execution of unusual processes/shell commands on the web server.
  • Unusual outgoing connections.

For less technically inclined users, https://research.eye.security/wp2shell-defenders-guide/ offers a WordPress plugin for checking for a wp2shell infection.

You don’t manage your WordPress site yourself?

Please forward the link to this Help Centre article immediately to your webmaster, IT department or the digital agency supporting you.

Where can I find more information?

You can find more information on the vulnerabilities in the National Vulnerability Database:

IONOS is working intensively on further security measures, and will inform you about further steps shortly. This Help Center article is continuously updated.

Improve the security of your WordPress installation

An important step to improve the security of your WordPress installation is to activate the built-in automatic update function via the dashboard:

  • Backup your website: Before applying any major updates, it is highly recommended to create a full backup of your website's files and database.
  • WordPress core: Click on Dashboard > Updates within your WordPress admin dashboard.
    Some WordPress versions hosted on IONOS offer an update option on the project page. This page opens automatically when you navigate within your IONOS account from Menu > Web Projects and click on the tile with the desired WordPress site.
  • WordPress plugins: Click on Plugins > Installed Plugins within your WordPress admin dashboard. In the plugins overview, you can activate automatic updates in the last column.

Note

Users of IONOS Managed Hosting for WordPress actively receive the latest updates.

Content