WordPress Security Alert (WP2Shell) - Update Now

A critical vulnerability has been disclosed in WordPress core, known as WP2Shell (CVE-2026-60137 and CVE-2026-63030). Chained together, they allow unauthenticated remote code execution, meaning an anonymous attacker can compromise a site even on a stock install with no plugins.

Affected versions: WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The fix is in versions 6.9.5 and 7.0.2.

Your protection
Our WAF (Web Application Firewall) is already blocking known exploitation attempts on our servers. Even so, updating is essential: the WAF is a defense layer and does not replace patching the software.

What you should do (web hosting customers)

• Update WordPress to version 6.9.5 or 7.0.2 immediately (Dashboard > Updates).
• Enable automatic updates for WordPress, plugins and themes, so you receive security fixes without delay.
• Update all plugins and themes as well.
• If you suspect your site has been compromised or need help updating, open a ticket and our team will assist.

The security of your sites is a priority. We will keep monitoring and strengthening protection.

The TurboHost Team