WordPress Attack Report: 1.69 Million Attacks, May to July 2026
Between May 1 and July 21, 2026, the ReportedIP network recorded 1,692,650 attacks from 206,388 unique IP addresses. This first quarterly WordPress Attack Report shows which techniques hit WordPress sites most often and how the wp2shell exploit showed up in the data.
The busiest day was June 17, 2026, with 29,217 attacks. Every figure below comes from the network’s own report data and is free to cite under CC BY 4.0.
How many attacks did ReportedIP record from May to July 2026?
The network counted 1,692,650 attacks in the 82 days from May 1 to July 21, 2026. Seven honeypot servers, decoy machines that imitate WordPress, Drupal and Joomla sites, logged 1,505,488 of them. Member API keys reported another 186,292, from WordPress sites running the Hive security plugin and from server integrations. The remaining 870 were imported by hand.
- 1,692,650 attacks in total
- 206,388 unique attacking IP addresses
- 29,217 attacks on the peak day, June 17, 2026
- 20,642 attacks per day on average
An attack in this report is one report plus the repeat events folded into it. When the same address hits the same target again within a short time, the network keeps one report and counts the repeats on it.
Did attack volume rise or fall between May and July 2026?
Attack volume stayed high and steady. In the eleven full Monday-to-Sunday weeks from May 4 to July 19, weekly attacks never fell below 133,000 and peaked at 179,476 in the week of June 15 to 21. That week also held the two busiest days: June 16 with 28,117 attacks and June 17 with 29,217.
One weekend inside this window has its own analysis. On May 23 and 24, 2026, the network counted 41,220 attacks in 37,288 attack reports from 15,066 addresses. The weekend attack report breaks those two days down by category and country.
Which attacks hit WordPress sites most often?
Most traffic was generic. 1,183,168 attacks carried the Hacking category and 246,620 the general Brute-Force category, and both hit any exposed service. Among the WordPress categories, login brute force against wp-login.php led by a wide margin. A report can carry several categories, so the rows overlap.
| WordPress attack category | Attacks |
|---|---|
| Login brute force | 130,856 |
| XML-RPC brute force | 23,602 |
| Plugin exploit attempts | 15,998 |
| User enumeration | 13,768 |
| Config file exposure | 12,660 |
| Plugin scanning | 10,609 |
| Core exploit attempts | 6,227 |
| Version scanning | 5,737 |
Reconnaissance is a large share. User enumeration, probing for exposed config files and plugin scanning each passed 10,000 attacks. These requests map the site for the next step: which usernames exist, which plugins are installed and which backup files are lying around.
How did wp2shell show up in the data?
wp2shell was disclosed on July 17, 2026, the same day WordPress shipped the fix in version 7.0.2. It is an unauthenticated remote code execution chain in WordPress core that combines a SQL injection (CVE-2026-60137) with a REST batch route-confusion bug (CVE-2026-63030). Rapid7’s technical analysis describes the chain in detail. CISA added both CVEs to its catalog of known exploited vulnerabilities on July 21.
Reports in the WordPress REST API abuse category rose around the disclosure. From July 11 to 17 the network received between 0 and 4 such reports a day, from July 18 to 20 it received 8 a day. The absolute numbers are small, but the jump starts the day after the disclosure.
Hive shipped two firewall rules two days after disclosure
On July 19, 2026, Hive 2.1.25 added the rules waf_rest_batch_desync and waf_rest_batch_nested to its web application firewall. Both belong to the free Paranoia-Level-1 baseline, so they apply on every plan as soon as a site runs Hive 2.1.25 or later. The admin-creation step of the chain relies on UNION SELECT, which the free rule waf_sqli_union blocked before this release.
The two new rules match the shape of the malformed batch request instead of a fixed payload string. Extra slashes, protocol-relative URLs and absolute URLs do not get past them, and normal batch calls pass. A firewall rule covers the time until every site has the core update. It does not replace the WordPress patch.
The Professional plan adds the deeper rulesets
An RCE like wp2shell is usually followed by a web shell upload. The Professional plan adds the Paranoia-Level-2 and Level-3 rulesets, including the web shell group, through an Ed25519-signed rule sync. Free installs receive new rules with plugin releases, Professional installs as soon as they ship.
How was the data collected?
All figures count the reports in the ReportedIP report database from May 1 to July 21, 2026 (Berlin time), including their repeat events. Categories follow the 63 threat categories of the platform. Reports carry the attacker IP, the category and the time. No user agents are sent by default, and no published number identifies a reporter.
The figures were counted for publication on July 23, 2026. A recount on September 29, 2026 gives 1,692,614 attacks from 206,378 addresses, because individual records have been removed since then.
The same data feeds the community blacklist. An address enters it at a confidence score of 75 % or higher, once its most recent report is at least 48 hours old.
Reuse and custom data
All figures and the chart in this report are licensed under CC BY 4.0. Reuse them in articles, papers or talks with a link to reportedip.com. For a custom time window, a country split or a quote, write to Patrick Schlesinger at 1@reportedip.com. The report archive is on the Threat Reports page.
What should WordPress operators do with these numbers?
- Expect constant load. Automated attacks never fell below 133,000 per week in this quarter.
- Protect the login and XML-RPC. Login and XML-RPC brute force lead the WordPress categories with 130,856 and 23,602 attacks.
- Close the patch window with a firewall. wp2shell showed the gap between disclosure and core update, and a firewall rule covers it.
- Keep plugins current. The rules that stop wp2shell exist from Hive 2.1.25 onward. View pricing for the Professional rule sync.
Frequently asked questions
How many attacks did ReportedIP record from May to July 2026?
ReportedIP recorded 1,692,650 attacks from 206,388 unique IP addresses between May 1 and July 21, 2026. Honeypot servers logged 1,505,488 of them, member sites and server integrations reported 186,292. The busiest day was June 17 with 29,217 attacks, and the busiest week ran from June 15 to 21.
What was the most common attack on WordPress sites?
Login brute force against wp-login.php was the most common WordPress attack, with 130,856 attacks between May 1 and July 21, 2026. XML-RPC brute force followed with 23,602 and plugin exploit attempts with 15,998. User enumeration, config file probing and plugin scanning each passed 10,000 attacks.
Were free Hive sites protected against wp2shell?
Free Hive sites were protected once they updated to Hive 2.1.25, released on July 19, 2026. Both wp2shell rules belong to the free Paranoia-Level-1 baseline that ships with the plugin on every plan. The firewall covers the time until the site runs the patched WordPress core, which remains the actual fix.
Read on
- Get Hive for WordPress: 16 sensors, the firewall and four 2FA methods in one plugin.
- wp2shell explained: the two bugs, the chain and how to block it.
- Honeypot server guide: run a sensor of your own and add to the next report.