Vulnerability check · WordPress
Is Your WordPress Site Exposed To wp2shell?
A passive check for the wp2shell flaw in WordPress core (CVE-2026-63030 chained with CVE-2026-60137). It reads the public version and compares it with the affected range. It never sends an exploit.
The tool runs on ATLAS, the free tool site by Brandefense. Opens in a new tab, no signup.
Verdict
Exposed
Version is inside the affected range.
- 6.9.0 to 6.9.4
- 7.0.0 to 7.0.1
Verdict
Patched
Version includes the fix.
- 6.9.5 or later
- 7.0.2 or later
- 6.8.x and earlier were never affected
Verdict
Needs a closer look
It looks like WordPress, but the version could not be read. Confirm it in the admin dashboard.
What you get
What You See On ATLAS.
- 01
A clear verdict
Exposed, already patched, or needs a closer look.
- 02
The affected range
WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 are exposed. 6.9.5 and 7.0.2 fix it. 6.8.x and earlier were never affected.
- 03
Next steps
Update to 6.9.5 or 7.0.2 or later. If the version cannot be read, confirm it in the WordPress admin.
Who it is for
Who Uses The WordPress Exposure Check.
- Site owners and web teams who run WordPress
- Agencies that look after many client sites
- Security teams that need a quick yes or no on one site
On the Brandefense platform
One flaw checked. The whole surface watched.
The check covers a single vulnerability. External attack surface management finds the sites, services and misconfigurations you did not know were public.
It checks only the flaw named on ATLAS, by reading the public version. Only check sites you own or may test. The flaw named is the one ATLAS tracks today and may change.