Phantom Freelance

WordPress Security Alert (WP2Shell): Here’s What You Need to Know

A critical pre-authentication remote code execution (RCE) vulnerability has been discovered in WordPress Core (the software that powers your website). Security researchers have nicknamed the exploit chain WP2Shell. Unlike most WordPress security issues, this is not caused by a plugin or theme—it affects WordPress itself.

Hackers are already using this vulnerability to target websites that haven't been updated, so if you're running an older version of WordPress, you should update as soon as possible.

The affected versions are:

• WordPress 7.0.0 and 7.0.1 → Update to 7.0.2
• WordPress 6.9.0 – 6.9.4 → Update to 6.9.5
• WordPress 6.8.x → Update to 6.8.6

If your website has already updated automatically or is managed by one of my WordPress Support Plans, you're likely protected. If you're not sure, keep reading—I'll show you how to check your site and make sure it hasn't already been compromised.

Check Whether Your WordPress Site Is Vulnerable

Security researchers have created a free online scanner that checks whether your website is vulnerable. Simply enter your website address and it will tell you whether your site is running an affected version.

WP2Shell Vulnerability Checker

What Should You Do Right Now?

1. Update WordPress

This is the most important step. Update to one of the below depending on your current version.

• WordPress 7.0.2
• or WordPress 6.9.5
• or WordPress 6.8.6

2. Check for New Administrator Accounts

If your website has been vulnerable for a while, it's a good idea to check whether any unexpected administrator accounts have been created. One of the first things attackers often do after compromising a website is create a new administrator account so they can regain access later—even after you've updated WordPress.

Here is some PHP code you can add to your functions.php file which adds an admin column to show the date that the user was registered.

Admin Registration Dates Column

/**
 * Add a "Created Date" column to the WordPress Users admin screen.
 */

// 1. Add the column header to the Users table
add_filter( 'manage_users_columns', 'add_user_created_date_column' );
function add_user_created_date_column( $columns ) {
    $columns['user_registered'] = 'Created Date';
    return $columns;
}

// 2. Populate the column rows with the registration date
add_filter( 'manage_users_custom_column', 'show_user_created_date_column_value', 10, 3 );
function show_user_created_date_column_value( $value, $column_name, $user_id ) {
    if ( 'user_registered' === $column_name ) {
        $user = get_userdata( $user_id );
        // Formats date based on your WordPress general settings
        return date_i18n( get_option( 'date_format' ) . ' ' . get_option( 'time_format' ), strtotime( $user->user_registered ) );
    }
    return $value;
}

// 3. Make the new column sortable
add_filter( 'manage_users_sortable_columns', 'make_user_created_date_column_sortable' );
function make_user_created_date_column_sortable( $columns ) {
    $columns['user_registered'] = 'user_registered';
    return $columns;
}

^{Please use code at your own risk.}

If you'd rather install a plugin than edit code, use this version I've bundled below.
Admin Registration Dates Column (Plugin)

3. If You Find Something Suspicious

Updating WordPress stops future attacks. It does not remove malware or undo changes an attacker may have already made.

If your website:

• has unknown administrator accounts
• is sending spam
• redirects visitors
• has strange files
• or you're simply unsure

it should be professionally checked.

Need Help?

If you'd rather have someone handle everything for you, I can:

• Update WordPress safely
• Check whether your website has been compromised
• Remove malware (if found)
• Check administrator accounts
• Secure your website against future attacks

Post a project on Codeable with me here
^{Mention this post and I’ll give you 20% off your first project with me, woo-hoo!}