This is real world example how we caught this exploit on our clients website!

The exploit:

It's called wp2shell (CVE-2026-63030 and CVE-2026-60137). It affects WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1. The fix was released on July 17 (7.0.2, 6.9.5 and 6.8.6). A public proof of concept exists, so bots scan the internet for unpatched sites automatically. Nobody targets you personally. Client website missed the update for about a month and got hacked on August 22. While checking our own servers we could see that other websites got the same attack in September, but they were already updated and it failed.

What they did?

- Created hidden admin accounts. They don't show up under Users in wp-admin.

- Installed a backdoor that puts itself back if you delete it. It lives in several places at once: `wp-content/db.php`, a file in `mu-plugins`, code at the end of `wp-config.php` and in theme files, hidden files in `wp-content/upgrade` and `wp-content/uploads`, and copies in the database. Clients host's malware scanner kept deleting files for weeks and they kept coming back.

- Got full remote control of the site.

- Turned off page caching for the whole site. That made the site slow: Search Console flagged slow mobile loading.(could be a sign)

Who they linked and why

Only when Googlebot opened the homepage, the site showed 89 links to UK websites (.co.uk and .org.uk) promoting "non GamStop" casinos. GamStop is the UK program people use to block themselves from gambling, so these casinos target people who are trying to stop. Regular visitors saw a normal page. The linked UK sites look like old small business and charity sites that were taken over too. The point is to borrow Google trust from real websites and pass it to casino pages. We found no redirects and no stolen passwords or form data.

What it means for the site owner

- Google sees your site linking to casino spam. That can bring a manual action or a security warning in Search Console.

- The site is slow because caching is off.

- The attacker could read everything on the hosting account, so treat database passwords and other secrets on that account as leaked.

How to check your site

1. Check your WordPress version under Dashboard > Updates. If it's below 7.0.2 (or 6.9.5 / 6.8.6 on older branches), update now. If it was below that at any point after July 17, do the checks below.
2. Open the users table in phpMyAdmin, not in wp-admin, and look for admins you don't recognize. They used emails ending in u/wordpress.org and names like backup_manager and cache_sync.
3. In File Manager, look for `wp-content/db.php`, unknown files in `wp-content/mu-plugins`, files starting with a dot in `wp-content/upgrade` and `wp-content/uploads`, and anything after the `require_once ABSPATH . 'wp-settings.php';` line in `wp-config.php`.
4. Load your homepage as Googlebot: `curl -A "Googlebot/2.1" https://yoursite.com/ | grep -i gamstop`. If anything comes back, you're infected.
5. If you use LiteSpeed Cache, check "Do Not Cache URIs". A single `/` there turns off caching for every page.
6. Check Security issues and Manual actions in Search Console.

If you find it

Make a backup first. Then remove every part in one go: files, database entries and hidden users. If you miss one, it brings the rest back. Reinstall WordPress core, your theme and plugins from clean copies, and change the salts and database passwords. Then request indexing of your homepage in Search Console. You are welcome stay stafe!