# Sorting out WordPress websites compromised by wp2shell.com
**URL:** https://community.coops.tech/t/sorting-out-wordpress-websites-compromised-by-wp2shell-com/4978
**Category:** Technology
**Tags:** wordpress
**Created:** [28 August 2026 08:36 UTC](https://community.coops.tech/t/sorting-out-wordpress-websites-compromised-by-wp2shell-com/4978 "2026-08-28T08:36:15Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@chris](https://community.coops.tech/u/chris)
#### Post date: [28 August 2026 08:36 UTC](https://community.coops.tech/t/sorting-out-wordpress-websites-compromised-by-wp2shell-com/4978/1 "2026-08-28T08:36:15Z")
Webarchitects provides hosting for a lot of WordPress sites, which clients manage themselves, many of these were hit badly by the [wp2shell vulnerability](https://wp2shell.com/) on 19th July 2026, following are some notes on what we have been doing to detect and sort out compromised sites.
I’d be interested in hearing what others are / have been doing?
## Using WP-CLI to detect compromised sites
The nightly version of the WordPress command line interface, [WP-CLI](https://wordpress.org/cli/), (note that there hasn’t been a release for ages, [version 3.0.0](https://github.com/wp-cli/wp-cli/issues/6322) will hopefully be released soon, the last release is too old to be used) can be used to detect compromises using:
```bash
wp core verify-checksums
wp plugin verify-checksums --all
wp user list
```
We have an Ansible role to install `WP-CLI`:
> **[webarch / wpcli · GitLab](https://git.coop/webarch/wpcli)**
>
> An Ansible role to install WP-CLI, the command-line interface for WordPress
## Restoring from a compromised site
Ideally a backup from prior to 19th of July should be used for restoring a compromised site, however this might not be available, in that case a fresh WP install and the following steps can be followed.
### Additional WP administrators
The users list from WP-CLI might not be complete, @liam found a compromised sites that omitted additional administrators from the output so best open a MariaDB / MySQL dump and search for the `wp_users` table, if it looks a bit like this:
```sql
LOCK TABLES `wp_users` WRITE;
/*!40000 ALTER TABLE `wp_users` DISABLE KEYS */;
INSERT INTO `wp_users` VALUES
...
(12,'wpsvc_24a94efb28f9','$wp$2y$10$rTb5pE6VwTk8paDZFN7r.OUR0C5dnRMl5OXwcDX2oB.Engoc3uXRi','wpsvc_24a94efb28f9','wpsvc_24a94efb28f9@wordpress-svc.internal','','2026-07-19 03:58:39','',0,'wpsvc_24a94efb28f9'),
(13,'wpsvc_782a3557d321','$wp$2y$10$ZDAltpECRVjj1RotLrKXOeAFdN5v7InPW12DZQ7m98DTADOtHCcQu','wpsvc_782a3557d321','wpsvc_782a3557d321@wordpress-svc.internal','','2026-07-19 05:34:43','',0,'wpsvc_782a3557d321'),
(14,'wp2_8cb6333de79a','$wp$2y$10$xxZXx3B3BAvtv.HktTqvPuV7maJQgnmU1vI0/RUuXwmnx3D5D6UMC','wp2_8cb6333de79a','wp2_8cb6333de79a@wp2shell.invalid','','2026-07-20 05:50:17','',0,'wp2_8cb6333de79a'),
(15,'wp2_ba36970ef717','$wp$2y$10$QvzJBACtXWmw9lAiW9IcjutMPPVrcjHyfqrd3entq5xmBk9uIKvdi','wp2_ba36970ef717','wp2_ba36970ef717@wp2shell.invalid','','2026-07-20 05:52:10','',0,'wp2_ba36970ef717'),
(16,'wpenginebot','$wp$2y$10$T64YfK0/9wgXA2AhdDV9k.pVSzQ/E3dApg5qeUfdz0eGP5/z2Vdf.','wpenginebot','wpenginebot@wpengine.com','','2026-07-20 13:51:19','',0,'wpenginebot'),
(17,'w2s_73e4d42cae40','$wp$2y$10$Pyc9/ctRa8ZVV4QnbWHoHeu.gNs4U0CtTAYtbQlhxMfDQSL3LIHP2','w2s_73e4d42cae40','w2s_73e4d42cae40@shellcode.lol','','2026-07-20 19:04:30','',0,'w2s_73e4d42cae40');
/*!40000 ALTER TABLE `wp_users` ENABLE KEYS */;
UNLOCK TABLES;
```
Then these account need deleting, note that the last `INSERT` needs to end in a `;` not a `,` prior to restoring from a dump like this.
### Uploads
The only directories and files that generally need copying are the `wp-content/uploads/2*` ones and these should only be image and PDF etc files, the web server should be set to dissallow PHP from running from `wp-content/uploads`, eg:
```xml
RemoveHandler .php
Require all denied
```
### Plugins
Install them all from upstream, not from the compromised site / account:
```bash
wp plugin install akismet
```
However note that any added on or after 19th July 2026 should not be installed! For example:
```bash
ls -lah /home/example/public_html/wp-content/plugins
drwxr-xr-x 26 example example 4.0K Aug 24 23:36 .
drwxr-xr-x 10 example example 4.0K Aug 25 02:32 ..
drwxr-xr-x 2 example example 4.0K Jul 19 03:59 content-delivery-helper-75658a
drwxr-xr-x 2 example example 4.0K Jul 20 08:51 mm
drwxr-xr-x 2 example example 4.0K Jul 19 05:34 security-headers-manager-b28343
```
Any paid for or custom ones can’t be installed like this.
### Themes
Best install from upstream:
```bash
wp theme install twentytwentyfive
```
However any paid for or custom ones can’t be installed like this.
## Updating WP core, plugins and themes daily
We are running this Bash script daily to update WordPress core, plugins and themes and also run the checksum tasks, as the user running the site, with the results being emailed to the owner of the site:
> **[bin/wp-update · master · webarch / scripts · GitLab](https://git.coop/webarch/scripts/-/blob/master/bin/wp-update)**
>
> Various scripts used on Webarchitects servers
Note that [false positives for `git` checkout plugins and themes](https://github.com/wp-cli/extension-command/issues/537) can be ignored with the addition of `--ignore-vcs` argument being used.
Of course there is the danger that an update might break things or a WP plugin might be compromised upstream and get installed before it is removed from `wordpress.org` however in our experience this is currently rare compared to the chance of an out of date site being compromised.
## Using Icinga to check WP checksums
We are adding the `wordpress-checksums` Icinga check for all sites to alert us to issues in the future, this can also be run using a shell:
> **[wordpress-checksums - Linuxfabrik Monitoring Plugins](https://linuxfabrik.github.io/monitoring-plugins/check-plugins/wordpress-checksums/)**
## Commercial scanners
These two WordPress CLI security scanners require you to pay to use their API:
> **[GitHub - wpscanteam/wpscan: WPScan WordPress security scanner. Written for...](https://github.com/wpscanteam/wpscan)**
>
> WPScan WordPress security scanner. Written for security professionals and blog maintainers to test the security of their WordPress websites. Contact us via contact@wpscan.com
> **[GitHub - wordfence/wordfence-cli: Wordfence malware and vulnerability scanner...](https://github.com/wordfence/wordfence-cli)**
>
> Wordfence malware and vulnerability scanner command line utility.
We have an Ansible role to install `wordfence` and intend to also write one for `wpscan` when we have time:
> **[webarch / wordfence · GitLab](https://git.coop/webarch/wordfence)**
>
> Ansible role to install the wordfence-cli on Debian and Ubuntu.
## Security forensics consultants
We haven’t used any of these organisations but they might be able to help in some circumstances (for example a WP compromise being escalated into a server compromise):
> **[Home | InterSecLab](https://interseclab.org/)**
>
> InterSecLab is a specialized digital security laboratory with advanced capabilities in digital forensics, research and threat intelligence.
> **[DIGITAL SECURITY HELPLINE - Access Now](https://www.accessnow.org/help/)**
>
> Our Helpline provides 24/7 free of charge technical support for journalists, activists, and human rights defenders
> **[Non-Profit Computer Security Consultancy](https://www.radicallyopensecurity.com/)**
>
> We're an idealistic bunch of security researchers, networking/forensics geeks, and Capture The Flag winners that are passionate about making the world more secure.
---
### Author:  [@usayd](https://community.coops.tech/u/usayd)
#### Post date: [21 September 2026 11:22 UTC](https://community.coops.tech/t/sorting-out-wordpress-websites-compromised-by-wp2shell-com/4978/2 "2026-09-21T11:22:53Z")
Using a WAF with cpguard / cpfence and a control panel that is well maintained has kept most things at bay. Cloudflare in front though I’d like to move away from this for lots of reasons