Published on 28 July 2026
Reports of sexualised violence, health consequences, private messages – highly sensitive data that people had entrusted to a protected space have, in all likelihood, fallen into the hands of criminals. Between 17 and 21 July 2026, attackers broke into the Protestant survivors' network "BeNe" via a critical WordPress security vulnerability and presumably copied large parts of the database. Germany's Federal Office for Information Security (BSI) has confirmed the incident and explicitly warns of subsequent phishing attacks against the affected users.
For you as the owner or decision-maker of a small or medium-sized business with a WordPress website, this case is more than a tragic one-off news item: it is a textbook example of how quickly an unpatched website can be taken over once a vulnerability becomes known. Because the exploited flaw does not affect some exotic plugin, but the core of WordPress itself – and thus potentially every fourth website worldwide.
"BeNe" (bene-netzwerk.ekd.de) is a platform run since 2024 by the Evangelical Church in Germany (EKD). Survivors of sexualised violence exchange views there in a protected space about personal experiences, health consequences and very private life situations. It is precisely this data that is now at the centre of a data breach.
On 17 July 2026, the security research firm Searchlight Cyber reported two critical security vulnerabilities in the WordPress core – summarised under the name "wp2shell". That same day, WordPress released the patched versions 6.9.5, 6.8.6 and 7.0.2. But the window for attackers was already open: over the weekend of 19/20 July, so-called proof-of-concept exploits appeared – freely available sample code demonstrating how the flaw can be exploited. Automated bots began attacking unpatched WordPress installations on a large scale. It was presumably during exactly this period that BeNe, too, was compromised.
The BSI published an official cybersecurity warning on 20 July (reference 2026-271984-1032). The EKD did not take BeNe offline until 21 July – apparently too late to prevent a compromise. On 22 July, the church confirmed that the vulnerabilities had been used for unauthorised access and that the attackers had created unauthorised administrator accounts. One day later, on 23 July, came the bitter update:
"It is now established that the security vulnerabilities were used to gain unauthorised access to the platform. […] Based on the available findings, it must be assumed with high probability that data was exfiltrated from the database on a larger scale. Judging by the pattern and scope of the accesses, this is with very high probability an automated bot attack and not a targeted attack on BeNe." – EKD, official statement of 23/07/2026
According to the EKD, what was exfiltrated were encrypted passwords, encrypted posts from private forums, and private messages. The encryption reduces the immediate risk – but does not eliminate it. If the attackers manage to decrypt the passwords, they could in a second step also make the associated private content readable.
Survivors' representative Detlev Zander described to the epd what this means for the people affected:
"It is precisely people whose boundaries and trust have already been gravely violated who are now experiencing a massive loss of control all over again."
"wp2shell" consists of two chained vulnerabilities in the WordPress core:
author__not_in parameter of the WP_Query class./wp-json/batch/v1. The REST API is an interface through which other programs communicate with WordPress – here, code can be executed without any login.In combination, the two flaws allow an anonymous, non-logged-in attacker to execute arbitrary code remotely on the web server – known in technical jargon as "Remote Code Execution" (RCE). What is particularly dangerous: it requires no preconditions, no credentials, and not even an installed plugin. Searchlight Cyber put it this way in its advisory:
"The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins. It is estimated that over 500 million websites use WordPress."
Dr. Christopher Kunz of heise security warned on 18 July: "The problematic thing is the chaining of both flaws […] Such security vulnerabilities are easy to automate and can lead to large-scale attacks." That is exactly what happened.
In the BeNe case, the attackers created unauthorised administrator accounts (pattern: wpsvc_[Hash]@wordpress-svc.internal) and installed malicious plugins such as "Database Repair Assistant" or plugins matching the pattern wp2s-[Hash]. In some cases, malicious code was injected into the files .htaccess and index.php, which then regenerated automatically after an update.
The vulnerable versions are WordPress 6.9.0 to 6.9.4 as well as 7.0.0 and 7.0.1. Not affected are versions 6.8.5 and older, as well as the patched versions 6.9.5, 6.8.6 and 7.0.2.
The scale: WordPress is used by around 43% of all websites worldwide – an estimated 472 to 595 million installations. Its CMS market share (CMS = system for managing website content) is roughly 59 to 63%. In Germany, too, the share is comparably high. In short: if your website runs on WordPress, you should read this article to the end.
According to IT blogger Günter Born, BeNe is one of the first publicly known victims. On 26 July, further cases came to light, including customers of the hosting provider IONOS, which notified affected customers by email.
wpsvc_[Hash]@wordpress-svc.internal.wp2s-[Hash].index.php and .htaccess in the root directory and in subfolders for injected code. It is suspicious if these files regenerate themselves./wp-json/batch/v1 or ?rest_route=/batch/v1.wp-config.php – they may have been read out during a compromise..htaccess and index.php. Caution: a mere update is not enough if the malicious code regenerates itself./wp-json/batch/v1 and ?rest_route=/batch/v1 for unauthenticated users.A BSI spokesperson summed up the dynamics to the epd: when vulnerabilities become known, a kind of "race" ensues – it comes down to "whether criminals or automated bots can gain access faster than a security update is installed." The bad news, he said, is that the data has presumably been copied and is on the internet. Still: the encryption of the exfiltrated passwords and content limits the risk.
How short this window is, is shown by the Patchstack Report 2026: the median time until mass exploitation of serious WordPress vulnerabilities is just five hours. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem – 42% more than the previous year. The vast majority of them (91%) are in plugins, only six affected the core. wp2shell is thus a rare but particularly dangerous core flaw.
For every website operator that processes personal data, such an incident is highly relevant. Under Art. 33 GDPR, you must report a data breach without delay, ideally within 72 hours of becoming aware of it, to the competent supervisory authority – unless it is unlikely to result in a risk to affected individuals. Since WordPress installations typically store email addresses, password hashes and other user data, a compromise should as a rule be treated as a reportable breach.
For particularly sensitive data – as in the BeNe case – Art. 34 GDPR additionally applies: the affected individuals must be notified directly if there is a high risk to their rights and freedoms. Failure to report, or late reporting, can be penalised under Art. 83(4) GDPR with fines of up to 10 million euros or 2% of global annual turnover. For SMEs the amounts are usually lower, but five- to six-figure sums are possible in the event of serious violations. Added to this are potential claims for damages from affected users under Art. 82 GDPR.
The BeNe incident is doubly tragic: it hits people who have already once lost trust and control – and it shows in brutal terms how little time lies between a published vulnerability and its mass exploitation. BeNe was only taken offline long after the BSI had already issued its warning. By then it was already too late to prevent a compromise.
The lesson for every SME with a WordPress website: don't wait. Check your WordPress version today, install the update to 7.0.2 or 6.9.5, and inspect your installation for traces of a compromise. Enable automatic security updates and set up a firewall. Because in the race between attackers and administrators, only those who are prepared win – not those who react only after the first warning.