Two new high severity WordPress vulnerabilities, patch immediately!
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-63030 +1 in the same advisory: …60137 | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use. | 9.8 group max | 97% | KEV PoC |
| massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable) |
Full article387 words · extracted from helpnetsecurity.com · click to collapse
The 7.0.2 WordPress security release addresses one critical and one high severity security issue.
The vulnerabilities reported to the WordPress security team include:
- CVE-2026-60137 – A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo
- CVE-2026-63030 – A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber
Which versions of WordPress are vulnerable?
- WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released containing fixes for both.
- WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released containing a fix.
- The beta release of WordPress 7.1 is affected by both vulnerabilities. Version 7.1 beta2 has been released containing fixes for both.
Versions of WordPress prior to 6.8 are not affected.
Emergency temporary mitigation
If this isn’t possible, security researchers at Searchlight Cyber note you can temporarily protect your instance by blocking anonymous access to the batch API, either by:
- Installing a plugin that blocks anonymous access to the rest API entirely; or
- Blocking
/wp-json/batch/v1and?rest_route=/batch/v1at a WAF level.
Note that both these solutions may have impact on legitimate use of the site and should only be considered emergency temporary measures until you can update.
UPDATE (July 20, 2026, 07:40 a.m. ET):
Searchlight Cyber researcher Adam Kues explained how he used GPT5.6 Sol Ultra to unearth CVE-2026-63030 and devise a working exploit.
“We held off on publishing this issue to give defenders a chance to upgrade their WordPress instances over the weekend, but during that time, Calif and Hacktron were able to independently reproduce the full chain before other PoCs surfaced on GitHub,” he noted.
“We continue to see attempted and successful wp2shell exploitation and have now handled several confirmed and suspected incidents,” Hexastrike head of CTI Maurice Fielenback said on Monday, after flagging initial exploitation attempts on Sunday.
Based on what they are seeing, they have compiled a (non-exhaustive) list of indicators of compromise and advised on incidence response steps.
UPDATE (July 21, 2026, 05:05 a.m. ET):
“As of Sunday, July 19, VulnCheck has verified more than two dozen unique PoCs targeting WP2Shell,” the cybersecurity company said.
Attackers have been using those various exploits to compromise vulnerable WP installations since late Friday evening, and are deploying webshells and creating backdoor admin accounts.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/