WP2Shell: What Irish WordPress Owners Need to Know About the 2026 AI-Assisted Vulnerability
If you run a WordPress site for a business, this is the kind of security update worth dealing with before you get back to the next task. In July 2026, WordPress fixed a serious vulnerability chain that could allow an unauthenticated attacker to reach remote code execution on affected versions. It was nicknamed WP2Shell.
What happened?
WP2Shell is not a problem with one random plugin. It is a chain of two bugs in WordPress core. The first involved the REST API batch route. The second was a SQL injection issue. Used together, the chain could give an attacker a way to run commands on a vulnerable site without logging in. I am deliberately leaving out exploit instructions here — the useful part for a site owner is knowing whether your update is in place.
WordPress released fixes on 17 July 2026: 7.0.2 for the 7.0 branch, 6.9.5 for 6.9 and 6.8.6 for 6.8. Versions before 6.8 were not affected according to the WordPress security release.
What does AI have to do with it?
The story made headlines because security researcher Adam Kues used GPT‑5.6 to help investigate WordPress. He gave the model the codebase and used several agents in parallel. The model found the SQL injection, then suggested a path that led to the full chain. Kues still had to untangle the result, reproduce it, check the impact and report it responsibly. So the accurate headline is AI-assisted discovery, not “AI hacked WordPress by itself”.
Could my site have been exposed?
Check the version first. Sites on WordPress 7.0.0–7.0.1 or 6.9.0–6.9.4 should be treated as exposed until the core update is installed. On the 6.8 branch, the SQL injection affected sites in combination with a plugin or theme that made the route reachable. If you are unsure which branch you were on, update to the latest supported release rather than trying to guess.
A practical 30-minute checklist
1. Take a fresh backup and make sure you can restore it. 2. Open Dashboard → Updates and update WordPress core to the latest version offered for your branch. 3. Update active plugins and the theme, then remove anything you no longer use. 4. Check Users and make sure every administrator account is recognised. 5. Look for new redirects, unknown posts, changed settings or unfamiliar files. 6. Ask your host for access and error logs if anything looks odd. 7. If you find signs of compromise, change WordPress, hosting, database and API credentials after taking a copy for investigation.
How can I check for signs of an attack?
Start with the boring checks: new admin users, password-reset emails nobody requested, unexpected plugins, modified theme files, redirects to unrelated domains and server requests at unusual times. A security scanner can help, but a clean scan is not proof that nothing happened. Your host’s logs are often more useful than a plugin dashboard. If the site handles payments or customer data, involve the host or a security professional instead of deleting suspicious files and hoping for the best.
What this means for a small business
The lesson is not to panic about every security headline. It is to have a small routine: automatic backups, a staging copy for updates, current WordPress core, fewer unused plugins and someone who checks the site after a major security release. AI will make vulnerability research faster for defenders and attackers. Keeping the basics in order is still the best protection.
The short version
Update affected WordPress sites, check administrator accounts and logs, and ask your host for help if anything looks unusual. Do not wait for a visible problem — a WordPress site can be compromised without obvious changes on the homepage.
Sources: WordPress 7.0.2 security release · Searchlight Cyber research on WP2Shell.