The security vulnerability known as wp2shell was fixed by the WordPress community in versions 6.8.6, 6.9.5, and 7.0.2. You can find details here: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
Which version of WordPress are you currently using?
Which version do you want to update to? You don’t have to switch to 7.0.2; you can also update to 6.9.5 if you aren’t already using that version.
Which plugin are you using for this marketplace? Is it up to date? I’m asking because these WordPress updates do not affect existing users or any other data. A database update through a WordPress update only changes structures in the database, not content there.
Thread Starter
Karen
(@kindpreneurs)
Hi @threadi thank you so much for replying 😊
When the users vanished, we were on wordpress version 6.9.
So when I reported the users missing, my hosting company said it was due to the wp2shell malware so they updated wordpress to 7.0.2. However that obviously did not magically restore the 2 users.
So I restored a back up of my live site from a few hours earlier to my staging site to test.
The users were present, however I was then prompted on my site to update the wordpress database and the 2 users then vanished again.
For our multi vender marketplace we use Dokan Lite and Dokan Pro. I have reported the incident to the Dokan plugin developers too, but they have not responded. My hosting company have also only responded one since I raised the emergency ticket 3 days ago. My site is in maintenance mode and my sellers are becoming anxious (as well as me!)
Unfortunately, that doesn’t quite answer my questions, so I’m still unsure what kind of system you currently have.
The database upgrade notification only appears when WordPress itself is being updated. My guess would therefore be that, after restoring the backup, you were back on WordPress 6.9.0, and WordPress detected that an update needed to be installed (which, in that sense, is correct, since it’s a security update). I don’t know which version you’ll have after this upgrade; you’ll have to check that yourself. Based on the database update, my guess is that you ended with version 7.0.2, which may not be compatible with the plugins you’re using – and that, in turn, could be causing your problem.
As I mentioned earlier, however, this update doesn’t affect any data. Users – especially if there are only two of them effected – don’t just disappear because of it. So I still think a plugin you’re using is the cause here. Dokan Pro is a commercial plugin, and we can’t help you with it here in the forum. You’ll have to wait for a response from them.
In the meantime, though, I would strongly recommend that you make sure your project hasn’t been hacked. You can do this with a security plugin or by running a scan with Sucuri: https://sitecheck.sucuri.net – if you don’t have a security plugin yet, pick one out here: https://wordpress.org/plugins/tags/security/
If you’re looking for personal assistance with this – because the feedback you’ve received from your service providers so far hasn’t been enough – you’re sure to find someone here: https://jobs.wordpress.net/
