Ocho Consultant

Your "WordPress Guy" Can't Save You From WordPress Itself

Posted on: November 3, 2026 · 3 min read

In July 2026, security researchers disclosed two flaws in WordPress Core — the engine itself, not a plugin, not a theme — that, chained together, give an attacker full remote control of your website. No password needed. No plugin needed. A stock, freshly installed WordPress site was enough.

The chain is called wp2shell (CVE-2026-63030 and CVE-2026-60137), and it works because of how WordPress and PHP live together: WordPress is PHP code that must execute on your server every single time someone visits your site. Every page. Every request. When a flaw lets an outsider slip instructions into that PHP engine, they don't "hack your login" — they ARE the server now. CISA added both flaws to its Known Exploited Vulnerabilities catalog, and researchers watched thousands of exploit attempts within hours of disclosure: stolen password hashes, malicious plugins installed as backdoors, complete site takeovers.

Here's the part that should worry a small business owner in Dallas–Fort Worth:

Most local businesses don't have a web team. They have "the WordPress guy" — someone who knows how to install WordPress, pick a theme, and add plugins. That's a real skill. But wp2shell showed the limits of that skill: this bug was in the CORE. No plugin choice would have saved you. No theme choice would have saved you. The fix was a version update that WordPress force-pushed — and the only question was whether your site actually applied it before an attacker's automated scan arrived. WordPress says more than 500 million sites run on it. That's not a community; that's an attack surface, and the bots never sleep.

This is why my rule will never change: ochoconsultant.com does not run WordPress. It's hand-built static HTML — about 2KB per page, no database, no PHP exposed to the internet, nothing to inject. It loads fast on a cheap phone over a slow connection, and there is no "core" to exploit. That's not a technology preference. It's a security posture, a speed posture, and an honesty posture, all in one.

If your business site runs WordPress, here's my straight answer, the same one I'd give you across the counter:

1. Update NOW — WordPress core, then every plugin and theme. Don't assume the auto-update worked; log in and verify the version (7.0.2+ on the 7.0 branch, 6.9.5+ on 6.9). 2. Ask your "WordPress guy" one question: "What version are we running, and when did we last update everything?" If the answer is vague, that's your answer. 3. If your site is mostly a brochure — hours, services, phone number — consider leaving WordPress entirely. A static site has nothing for wp2shell (or the next one) to grab.

Fear sells web maintenance contracts. I'd rather sell you the truth: the danger isn't that WordPress is bad software. It's that a tool with 500 million installations, running live PHP code on every request, in the hands of whoever answered the Craigslist ad — is a bet your business shouldn't have to make.

— Charles Ochoa, Ocho Consultant. Computer repair, sprinkler repair, and websites built the honest way — light, fast, and hard to hack. Bilingual service across Dallas–Fort Worth.

← All posts

Ocho Consultant · Dallas–Fort Worth · (214) 202-4792 · Bilingual service — Se habla Español · TCEQ LI0028991