That WordPress Emergency Patch Was Real. Here Is What Charlotte Business Owners Should Check Today

If your business website runs on WordPress, this one is worth five minutes of your day.

On Friday, July 17, WordPress shipped emergency security releases and, unusually, turned on forced automatic updates to push them out. Security firms including Rapid7 and Malwarebytes, along with outlets like The Register and The Hacker News, have been covering the fallout ever since. Within hours of the fix going out, attackers were already exploiting sites that had not gotten it yet.

Here is what happened, why this one is different from the usual WordPress security noise, and exactly what to check on your own site today.

What happened

Researchers found two flaws in WordPress core, the software itself, tracked as CVE-2026-63030 and CVE-2026-60137. On their own, each is bad. Chained together, in an attack researchers nicknamed "wp2shell," they let someone on the internet run their own code on your WordPress site with a single anonymous web request.

No password needed. No stolen login. No vulnerable plugin required. A fresh, bare WordPress install with nothing added to it was exploitable.

Every site running WordPress 6.9 or 7.0 was vulnerable until the emergency versions, 6.9.5 and 7.0.2, went out on July 17.

"Run their own code on your site" sounds abstract, so here is what it means for a business owner in practice. An attacker who gets that level of access can read the customer inquiries that come through your contact forms, quietly redirect your visitors to scam pages, deface your site, plant malware that infects the people who visit you, or steal whatever customer data your site collects.

Why this one is different

WordPress security problems are usually plugin problems. The standard advice has always been: keep plugins to a minimum, keep them updated, and you are mostly fine.

That advice did not help here. This flaw was in WordPress itself. Running a lean site with few plugins, which is genuinely good practice, saved no one this time. That is why WordPress took the unusual step of forcing the update out rather than waiting for site owners to click the button.

The other reason this one matters: speed. As Rapid7 and The Hacker News reported, attackers reverse-engineered the patch and began mass exploitation within hours of its release, first pulling hashed login credentials from unpatched sites using publicly available exploit code, then escalating to full remote code execution. By Saturday morning, exploitation was widespread. The window between "fix available" and "actively attacked" was measured in hours, not weeks.

WordPress powers hundreds of millions of websites. Many hosting companies patched their customers automatically. Plenty of self-managed sites were not so lucky.

If you want a deeper technical walkthrough, the YouTube channel Low Level covered it in a video titled "Wordpress Situation is Absolutely Insane," which tells you roughly how the security community reacted.

What to check today

This takes about five minutes.

1. Log in to your WordPress admin (usually yourwebsite.com/wp-admin).
2. Go to Dashboard, then Updates.
3. Check the version number. You want to see 6.9.5, 7.0.2, or anything newer.

If you see one of those versions, your site received the fix. Good.

If the version is older, update immediately. Treat it as urgent, not as a weekend task.

If you cannot log in at all, or you do not know your login, treat that as urgent too. You need someone to verify the site's status today.

Signs something may already be wrong

Because attacks started before many sites were patched, it is worth a quick look around even if your version number is current now:

• Admin users you did not create. Check Users in your WordPress dashboard for unfamiliar accounts with administrator access.
• Strange redirects. Visit your own site from a phone or a different browser. If you land somewhere unexpected, that is a red flag.
• Pages or posts you did not write, or files and plugins you do not recognize.
• Warnings from Google or from visitors saying your site was flagged as deceptive or unsafe.

If you spot any of these, do not just delete things and hope. Get help from whoever manages your site, change your passwords, and make sure the site gets properly cleaned. A compromised site that looks fixed often is not.

The honest takeaway

Most business owners we talk to in Charlotte did not hear about any of this until now, and that is normal. You run a business. Reading security bulletins is nobody's idea of a good Tuesday.

But this episode is a clear picture of what "owning a website" quietly includes: someone has to see the alert, understand it, and act on it within hours, because that is how fast this one moved.

If you know exactly who does that for your site, you are in good shape. If you paused on that question, that is the gap worth closing.

At 704MKT we design, build, and host websites for Charlotte businesses, and we manage them on an ongoing basis so that updates like this are handled as part of the job, not left waiting for someone to notice. If you are not sure where your WordPress site stands after this month, reach out and we will take a look with you.

Do the five-minute check today. Dashboard, Updates, version number. It is the cheapest insurance you will buy all year.

Sources: reporting and analysis from Rapid7, Malwarebytes, The Register, The Hacker News, and Help Net Security.