WordPress website security: What can we learn from new waves of cyberattacks?

In 2026, website security has been put to the test by several critical vulnerabilities and rapidly spreading cyberattacks. The wp2shell vulnerability disclosed in July allowed attackers to compromise WordPress websites without login credentials. In October, new critical vulnerabilities were disclosed in PHP, threatening the server environments that WordPress websites rely on.

The attacks have also reached Finland. The Finnish Transport and Communications Agency’s National Cyber Security Centre confirmed that attackers successfully exploited the wp2shell vulnerability to compromise WordPress websites in Finland.

These vulnerabilities demonstrate how quickly the security landscape can change and why ongoing security maintenance is so important. Even with proper security measures in place, not every attack can be prevented. However, effective protection, active monitoring, and a rapid response can reduce risks and limit the damage caused by security breaches.

WordPress remains a secure and reliable platform when properly maintained. In this article, we examine significant vulnerabilities discovered in 2026, how attackers exploit them, and what it takes to keep a WordPress website secure today.

What happened to WordPress in the summer of 2026?

Two security vulnerabilities were discovered in WordPress in the summer of 2026. Attackers could exploit them together to create a critical exploit chain known as wp2shell, allowing them to compromise websites without a username or password. WordPress released urgent security updates to address the vulnerabilities on July 17, 2026.

The exploit chain consisted of two vulnerabilities:

• CVE-2026-63030: A vulnerability in the WordPress REST API batch endpoint that allowed attackers to bypass certain API checks. The REST API is an interface that allows applications and other systems to interact with WordPress data. The batch endpoint enables multiple requests to be processed together.
• CVE-2026-60137: A SQL injection vulnerability that allowed attackers to manipulate database queries. Through SQL injection, an attacker may be able to access information they would not normally have permission to read.

By chaining these vulnerabilities, an attacker could create an administrator account on the website and use it to execute their own code on the server. This is known as remote code execution (RCE).

The attack required neither authentication nor vulnerable plugins, making it particularly serious.

According to Wordfence’s technical analysis, the wp2shell exploit chain affected WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The SQL injection vulnerability also affected versions 6.8.0–6.8.5.

Security fixes were released in WordPress versions 6.8.6, 6.9.5, and 7.0.2. Due to the severity of the vulnerabilities, WordPress also initiated forced automatic updates.

If your website is running an outdated WordPress version, it should be updated to the latest stable release as soon as possible. Simply enabling automatic updates is not enough. It is also important to verify that updates have been installed successfully and that the website and its features continue to function properly.

Why was wp2shell such a serious vulnerability?

WordPress security vulnerabilities are often found in plugins or themes. In those cases, the risk is limited to websites using the affected plugin or theme.

Wp2shell was discovered in WordPress core, meaning the fundamental components of the content management system itself. As a result, even websites using only a few carefully selected plugins could be affected.

Another major concern was how quickly the attacks began. According to Wordfence, attackers started targeting vulnerable WordPress websites on July 17, the same day the security updates were released. Widespread exploitation began the following day. Wordfence reported blocking more than 11 million attack attempts related to the wp2shell vulnerability.

This figure illustrates the enormous volume of attack attempts. Fortunately, the number of successful breaches was significantly lower.

AI is also accelerating the discovery of security vulnerabilities

AI played a significant role in the events of summer 2026. Adam Kues, a security researcher at Searchlight Cyber, discovered the wp2shell exploit chain using OpenAI’s GPT-5.6 Sol Ultra model. According to the researcher, AI enabled him to identify the vulnerabilities and develop a working exploit in approximately ten hours.

A Dark Reading article examines the role of AI in discovering the vulnerability. AI is helping security researchers identify and address vulnerabilities earlier. Unfortunately, attackers can take advantage of the same capabilities.

Finding vulnerabilities, developing exploit code, and automating attacks can now happen faster than before. In practice, website administrators may have very little time to respond to a new security threat.

WordPress websites were also compromised in Finland

These were not merely attempted attacks. According to vulnerability advisory 18/2026 published by Finland’s National Cyber Security Centre in July, attackers successfully exploited the wp2shell vulnerability to compromise WordPress websites in Finland. The agency urged website administrators to install the security updates immediately and investigate any potential breaches of affected websites.

The attacks continued throughout the summer. According to an August announcement by Traficom, WordPress websites had already been targeted earlier in the spring, particularly through plugin vulnerabilities. During the summer, attackers also began exploiting the critical vulnerability in WordPress core.

The National Cyber Security Centre also emphasized the importance of keeping websites and plugins updated, removing unnecessary plugins and user accounts, and actively monitoring vulnerabilities.

What can happen when a WordPress website is compromised?

A security breach does not necessarily cause immediate visible changes to a website’s appearance or functionality. An attacker may gain access to website data and install malicious code while the site continues to appear completely normal to visitors.

Several methods of exploiting compromised websites were observed during the wp2shell attacks. Research by Wordfence and Wiz identified the following techniques:

• Installing backdoors. Attackers could leave behind a web shell, a malicious program running on the server, or disguise malicious code as a legitimate plugin. A backdoor allows attackers to regain access later, even after the original vulnerability has been patched.
• Creating unauthorized administrator accounts. Attackers could create new WordPress administrator accounts. These accounts provide extensive permissions to modify website content, install plugins, and manage the website.
• Targeting website visitors with scams. Attackers may add fraudulent login pages to compromised websites, impersonating services such as Microsoft 365 or Google. These pages can be used to steal visitors’ login credentials or redirect them to malicious websites.

Security updates alone may not be enough

If an attacker has already compromised a website, fixing the vulnerability does not automatically remove the changes they have made. Backdoors, malicious files, and unauthorized user accounts may remain on the website, allowing the attacker to regain access.

For this reason, suspected breaches should be investigated for evidence of malicious activity. Items to check include unknown admin accounts, suspicious plugins, unusual PHP files, scheduled tasks, and server logs. PHP is the programming language used to build much of WordPress’s functionality.

Server logs can help determine what types of requests have been sent to the server and whether unusual activity has occurred. Investigating a security breach and cleaning up a compromised website should always be handled by a specialist. In addition to removing malicious code, it may be necessary to change passwords and security keys or restore the website from a trusted backup.

How to protect your WordPress website in practice

Protecting a WordPress website involves several security measures that must be implemented and monitored regularly. The following checklist can help you assess your website’s current security and determine whether your maintenance arrangements cover everything necessary.

1. Keep WordPress, themes, and plugins up to date

WordPress and plugin updates often include security fixes that prevent known vulnerabilities from being exploited.

Automatic updates can speed up the installation of security patches, but it is important to verify that they work as intended. Updates can also cause compatibility issues that affect the website’s appearance or functionality.

Professional website maintenance includes checking the impact of updates and resolving any resulting problems. Critical security updates must be implemented quickly.

2. Remove unnecessary plugins and themes

Every plugin installed on a website may contain security vulnerabilities. The more plugins a website uses, the more updates, compatibility issues, and security risks need to be monitored.

Unnecessary plugins and themes should be removed completely. Simply deactivating them may not be enough, as their files can remain on the server.

In addition to the number of plugins, it is important to assess their quality, how actively their developers maintain them, and whether updates are available.

3. Strengthen user account security

Weak passwords or passwords reused across multiple services increase the risk of attackers gaining access to the WordPress admin dashboard.

Use strong, unique passwords, a password manager, and multi-factor authentication (MFA). MFA requires an additional verification method beyond the password, such as a one-time code generated by an authentication app.

User permissions should also be limited according to each person’s responsibilities. Not everyone who creates website content needs administrator privileges. Unnecessary and outdated user accounts should be removed regularly.

Access to the WordPress admin dashboard and its interfaces should also be restricted where appropriate. For example, limiting login attempts can help prevent automated password attacks. The XML-RPC interface can be disabled if the website does not require it.

It is also advisable to disable the built-in theme and plugin file editors in the WordPress admin dashboard. This makes it more difficult for attackers to modify PHP code if they manage to compromise the website.

4. Use a WAF (Web Application Firewall)

A WAF (Web Application Firewall) examines incoming HTTP and HTTPS requests and attempts to block malicious traffic before it reaches the website.

For example, one temporary protective measure against the wp2shell vulnerability was to use WAF rules to block unauthenticated access to the WordPress REST API batch endpoint until the security update could be installed. However, API restrictions must be planned according to each website’s requirements to avoid disrupting necessary functionality.

WAF protection is available from providers such as Cloudflare, Sucuri, and Wordfence. Cloudflare also offers a content delivery network (CDN), which distributes website content across servers and can improve loading speeds, as well as protection against distributed denial-of-service (DDoS) attacks.

However, a WAF cannot detect every attack, so its security rules must be updated as new threats emerge.

WAF protection is included as standard in Hurja’s server environments. It is part of our website security measures, which we continuously improve in response to new vulnerabilities, attack methods, and technologies.

5. Maintain server environment security

WordPress security also depends on the server environment in which the website operates. A secure environment includes server firewalls, regular operating system and software updates, malware detection, and an SSL/TLS certificate that enables secure HTTPS connections.

The PHP version running on the server must also be kept secure, as WordPress updates do not fix vulnerabilities in the PHP programming language. Critical security updates may require urgent server-level action and verification that the website continues to function properly afterward.

Separating development and production environments is also important. Testing new features and major updates in a separate environment reduces the risk of changes causing problems on the live website.

We also recommend hosting servers in Finland. At Hurja, we use Hetzner virtual servers located in Finnish data centers, as described on our sustainability page. In addition to server location, it is important to consider the hosting provider’s security practices, backup procedures, and data handling policies.

6. Back up your website and test the restoration process

Regular backups are an essential part of preparing for security breaches and other unexpected incidents.

Backups should include both website files and the database. They must be stored separately from the live website to prevent them from being lost or compromised during the same security incident or server failure.

For many websites, daily automated backups are a good starting point. However, the appropriate backup frequency depends on how often website data changes.

It is also important to verify that the website can actually be restored from its backups. The restoration process should therefore be tested regularly.

7. Monitor website activity and security incidents

Regular security scans help identify malicious files, known vulnerabilities, and other suspicious changes.

Monitoring server logs can reveal unusually high numbers of login attempts, suspicious API requests, or other abnormal traffic.

A WordPress activity log can also track changes made through the admin dashboard, including user logins, the creation of new user accounts, and plugin installations. For example, attackers exploiting wp2shell could create unauthorized administrator accounts, and these events could potentially be detected through an activity log.

Logs make it easier to investigate unusual activity, provided they are stored securely and remain reliable even after a potential security breach.

Not every breach is detected immediately, and a single security scan cannot guarantee that a website is secure. Monitoring must therefore be continuous, with the ability to respond quickly to detected issues.

A security specialist is also responsible for assessing which findings require immediate action and which can be addressed as part of routine maintenance.

8. Assess your website’s current security with an audit

If you are unsure about your website’s security, a comprehensive audit can help identify potential risks.

A WordPress website audit can identify outdated software versions, vulnerable plugins, security weaknesses, and potential risks related to personal data processing.

The audit findings can then be used to plan necessary fixes and determine how ongoing website maintenance should be organized.

9. Prepare an incident response plan for security breaches

Not every security breach can be prevented, so it is important to prepare for potential incidents in advance. A clear response plan helps speed up the response and limit potential damage.

The plan should define who is responsible for investigating security incidents, who should be contacted, and how the website can be temporarily taken offline or isolated from the network if necessary. It should also establish which backups can be used to restore the website and how restoration can be carried out safely. If a breach involves personal data, any notification obligations under applicable data protection laws must also be assessed.

Having an incident response process agreed upon with a specialist makes it easier to handle a breach. Valuable time does not have to be spent identifying responsible personnel or developing a response from scratch.

Keep your website secure with our WordPress maintenance service

New waves of cyberattacks demonstrate how quickly the security landscape can change for WordPress websites and how little time may be available to respond to emerging threats. Maintaining website security requires ongoing expertise, but you do not have to manage everything yourself. What matters most is having a qualified specialist responsible for your website’s security and prepared to act quickly.

The PHP vulnerabilities discovered in October also kept Hurja’s team busy. When security patches began becoming available at around 5 p.m. Finnish time on October 21, 2026, our specialists continued updating servers well into the evening. Most of the servers we manage were updated that same evening, while the remaining servers were protected through alternative measures. Monitoring and outstanding updates continued over the following days.

At Hurja, our WordPress specialists handle website updates, security scans, and backups as part of our WordPress maintenance service. Our servers are located in Finland and include WAF protection as standard. We continuously improve our security practices and technical solutions in response to emerging threats and attack methods.

If your website currently has hosting but no one is responsible for its ongoing WordPress maintenance, it is important to address this as soon as possible. With a specialist handling maintenance, you can focus on your business knowing that your website’s security is being taken care of.

Does your WordPress website need ongoing maintenance, or would you like to assess its current security? Contact us, and we’ll help you find the right solution for your website.