WordPress Left Your Site Wide Open. The Feds Noticed.

Bob didn't touch his website in July. He was on a job every day that week. He didn't need to touch it, because for a few days this summer anybody on the internet could have walked into it without a password.

That wasn't a plugin he added. It wasn't a weak password. It wasn't a link he clicked. It was a hole in WordPress itself, the software running under his whole site.

Every WordPress post I've written told you the same thing. It's not core, it's the plugins. July made me eat that line. Then the feds looked at it and gave their own agencies three days to patch.

TL;DR (the short answer)

Yes, WordPress core itself had a hole in July 2026, and your password had nothing to do with it. Two flaws chained together into what researchers nicknamed wp2shell, and the main one, CVE-2026-63030, is rated 9.8 out of 10 and needs no login at all. WordPress patched it on July 17, 2026 in versions 6.8.6, 6.9.5 and 7.0.2, and forced the update out automatically because of how bad it was. Four days later CISA added it to the government's list of holes being used right now and gave federal agencies until July 24 to fix it.

3 Things to Remember

For Years I Told You It Was the Plugins. July Proved Me Wrong.

The hole was in WordPress core this time, not in some plugin you installed and forgot. That's new, and that's why this one is worth your ten minutes.

Here's what broke, in plain words. WordPress has a side door called the REST API. It's there on purpose so apps and tools can talk to your site. One part of that door, the batch endpoint, lets somebody send a stack of requests all at once instead of one at a time.

CVE-2026-63030 let an attacker aim that stack at the wrong room. WordPress got confused about which door it had actually opened. The security people call it route confusion. (NVD, 2026)

Then they chained it to a second bug, CVE-2026-60137. That one lives in the spot where WordPress asks the database for posts and skips certain authors. Feed it something crooked and you're not asking the database a question anymore. You're giving it orders.

Put the two together and a stranger reads your database, then runs their own code on your server. Researchers nicknamed the pair wp2shell. A shell is a command line. On your server. Nobody logged in.

I've spent years telling you the danger lives in the plugin pile you can't safely remove, and that's still true most weeks. Wordfence logs hundreds of WordPress holes in a single week, and nearly all of them are plugins. July was the week the floor cracked instead of the furniture.

The mistake: thinking "I keep my plugins updated, so I'm covered."

The fix: find out what core version your site runs and get it in writing who is responsible for patching it.

The payoff: you stop guessing whether your site is sitting open between jobs.

No Password Means Nobody Had to Guess Yours.

The word on the report is unauthenticated. In plain English, the attacker never had to log in to anything.

Almost everything you have been told about website security is about the front door. Long password. Two-factor. Don't use admin as your username. All good advice. None of it did a thing here.

This attack didn't knock on the front door. It went in through a service door WordPress leaves open for software, not for people. Your password wasn't wrong. It was never part of the conversation.

Sit with that for a second. You can do everything right and still be wide open, because the hole is in the floor, not the lock.

The Government Gave Its Own Agencies 3 Days. For a Website.

CISA added this flaw to the Known Exploited Vulnerabilities catalog on July 21, 2026, with a federal patch deadline of July 24. (CISA, 2026)

That catalog is not a "someday somebody might" list. A flaw only lands on it when it's being used in the real world right now. Once it's on there, federal agencies get a hard date to patch it or pull the thing offline.

Four WordPress flaws made that list before this one. Every single one of them was a plugin. This was the first time it was WordPress itself. (Tenable, 2026)

Here's the part that should land. Those agencies have security teams, patch schedules, and people whose entire job is watching for exactly this. They got three days and it was tight. You've got a truck, a phone, and a jobs list.

Your WordPress Site Was Safe Only If an Update Landed While You Were on a Job.

WordPress forced the fix out automatically on July 17, 2026, and for most sites that is the only reason the hole ever closed. (WordPress.org, 2026)

Read that again. Your site was fine because somebody else's automatic update reached it in time. Not because you were careful. Not because you did anything at all.

Here is the whole thing on one short list. Check yours against it.

• WordPress 6.9.0 through 6.9.4 was open to both flaws.
• WordPress 7.0.0 through 7.0.1 was open to both flaws.
• WordPress 6.8 through 6.8.5 was open to the half that reaches your database.
• 6.8.6, 6.9.5 and 7.0.2 are the fixed versions. All three shipped July 17, 2026.
• Anything at or above those numbers is patched for this one. (WordPress.org, 2026)

Plenty of sites never got it. Some have auto updates switched off because an update broke the site once and nobody wanted a repeat. Some are pinned to an old version by a theme or a page builder that won't run on the new one. Some are managed by a guy who stopped answering the phone two years ago.

The mistake: treating "there's a patch" and "I'm patched" like they are the same sentence.

The fix: check today what version you run and whether automatic core updates are turned on.

The payoff: you stop hearing about your own website from a stranger.

You are a plain-talking website helper. My website is [PASTE YOUR WEBSITE URL] and I think it runs WordPress. Walk me through this on my phone, in order: 1) how to find the exact WordPress version my site is running, step by step, 2) whether that version is older than 6.8.6, 6.9.5 or 7.0.2, which are the July 17 2026 core security fixes, 3) how to tell if automatic updates are turned on, 4) the exact questions to ask whoever manages my site about the date that patch was applied, 5) what to do today if nobody can give me a straight answer. Short sentences. No jargon. If you have to use a technical word, explain it in the same sentence.

A Site With No Login Screen Can't Be Logged Into.

The reason my builds don't have this problem is boring. There is no database to inject and no admin door to confuse.

A WordPress site builds your page fresh every single time somebody visits. It runs code, asks the database a pile of questions, loads every plugin, then hands over a page. Every one of those steps is a place to attack.

The sites I build are already built. The pages are finished files sitting on a fast network. A buyer hits your site and there is nothing to run and nothing to ask. There is just a page.

That's not me being clever. It's fewer moving parts. Fewer parts, fewer doors. That is the whole idea behind the 100K Website, and it is why I say the old machine is done for real business sites.

And you are not the one on patch duty. That job is mine. You go run your business.

Where WordPress Got This Exactly Right.

I'll give WordPress full credit here, and you should weigh it before you take my side.

They shipped fixes for three separate release lines on the same day, July 17, 2026, and patched all the way back to 6.8 instead of telling older sites to upgrade first and then get protected. Then they turned on forced automatic updates because of how severe it was. (WordPress.org, 2026)

That's a serious response. Plenty of software would have patched the newest version and left everyone else holding it.

Now the turn. It took an emergency release across three versions, a forced update, and a federal deadline to close one hole. And core is the small part of your site. The rest is plugins and themes written by people you have never met, updating on their own schedule, forever, on your site.

Your Website Shouldn't Need an Emergency.

You didn't get into business to track version numbers. You got into it to do the work and get paid. A website should be the quiet part of your week.

Let me show you what a site with nothing to break into actually feels like, built on your own market.

Take a Test Drive →

You get a real look at your own market. No obligation, and nothing to cancel.

Want the whole playbook first? Plan your attack. Balls Out Marketing.

FAQ