Loading story…
WordPress released 7.0.2 to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including CVE-2026-63030 and CVE-2026-60137. The flaws affect default WordPress installations without plugins, with the RCE path impacting 6.9.0 through 6.9.4, 7.0.0 through 7.0.1, and 7.1 beta, while the SQL injection issue also affects the 6.8 branch. WordPress issued backported fixes in 6.9.5, 6.8.6, and 7.1 Beta 2, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise.
Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
See affected versions and whether adversaries are exploiting it.
17 events from the most recent confirmed update back to the earliest known activity.
A ProjectDiscovery Nuclei templates pull request updated CVE-2026-63030 detection logic by replacing a timing-based blind SQL injection check with a deterministic route-confusion probe. The change was intended to reduce false negatives, avoid WAF-related flakiness, and lessen availability impact while keeping a WordPress pre-check to limit false positives.
A Rapid7 Metasploit Framework pull request published an auxiliary scanner module for the WordPress wp2shell chain that verifies the route-confusion primitive, confirms time-based blind SQL injection, and can extract WordPress usernames and password hashes. Unlike the previously noted draft RCE module, this module is described as read-only and does not create content on the target site.
A Rapid7 Metasploit Framework pull request published a draft module, `exploit/multi/http/wp_batch_desync_rce`, for exploiting the WordPress wp2shell chain involving CVE-2026-63030 and CVE-2026-60137. The module automates SQL injection-based discovery, administrator account creation, malicious plugin upload, Meterpreter session establishment, and cleanup steps.
On 2026-07-20, Wiz reported observed exploitation of vulnerable self-hosted WordPress instances in cloud environments and described post-compromise activity including malicious plugin uploads, user enumeration, local file inclusion attempts for wp-config data, and admin-panel access. The report also documented multiple PHP webshell/plugin variants and highlighted detection indicators such as requests to batch REST API endpoints, HTTP 207/200 Multi-Status responses, and user agents containing "wp2shell" or "rezwp2shell."
By early 2026-07-19, multiple security researchers reported broad exploitation of the WordPress wp2shell chain, including credential exfiltration, creation of backdoor administrator accounts, and deployment of malicious plugins. The reporting also described tens of thousands of attack attempts and more than two dozen public proof-of-concept exploits circulating after disclosure.
A defender-focused wp2shell guide was published describing forensic artifacts for compromise assessment and incident response. The release also promoted a WordPress compromise scanner plugin and a browser extension for checking whether sites had been patched.
A Fortbridge research post publicly detailed how CVE-2026-63030 and CVE-2026-60137 can be chained on a default WordPress installation to achieve unauthenticated PHP code execution. The write-up described route-confusion bypass, SQL injection, administrator account creation without cracking hashes, plugin upload, and direct execution, along with detection and mitigation guidance.
On 2026-07-21, CISA added CVE-2026-63030 to its Known Exploited Vulnerabilities catalog and marked the WordPress flaw as actively exploited, automatable, and having total technical impact. The listing elevated the vulnerability's status beyond prior researcher and vendor exploitation reports.
BleepingComputer reported that watchTowr observed early signs of in-the-wild exploitation targeting the public 'wp2shell' WordPress flaw chain after exploit code became available. This marked an escalation from public proof-of-concept release to apparent real-world attack activity.
On 2026-07-18, a GitHub repository published independent proof-of-concept code for exploiting the unauthenticated route-confusion SQL injection in the WordPress REST batch endpoint. The repository demonstrated database-read and blind SQL injection techniques but did not claim to reproduce Searchlight Cyber's undisclosed pre-authentication RCE path.
Wordfence stated it deployed firewall protection for premium customers on 2026-07-17 for the WordPress vulnerability chain. The same protection was scheduled for free users on 2026-08-16, but that future rollout is not treated as an event date here.
On 2026-07-17, a ProjectDiscovery Nuclei templates pull request added and updated a detection template for WordPress wp2shell. The changes included advisory references and template metadata updates.
Cloudflare deployed blocking WAF rules for CVE-2026-60137 and CVE-2026-63030 on 2026-07-17 at 17:03 UTC for customers. The company described the protections as a temporary mitigation and urged users to patch WordPress.
A GitHub Security Advisory published on 2026-07-17 disclosed CVE-2026-63030 as a critical unauthenticated remote code execution vulnerability in WordPress Core. The advisory identified affected versions and the patched releases.
On 2026-07-17, WordPress disclosed and patched two core vulnerabilities, CVE-2026-60137 and CVE-2026-63030, releasing fixes in 7.0.2, 6.9.5, 6.8.6, and 7.1 Beta 2. The issues could be chained into unauthenticated remote code execution on affected versions, and WordPress enabled forced automatic updates for vulnerable installations.
Elastic Security Labs published defender guidance for detecting the wp2shell WordPress pre-auth RCE chain, describing lab-observed Linux host artifacts such as web server child processes spawning shells, plugin-directory file creation, and recognizable access-log markers from public tooling. The article mapped the attack chain to Elastic Defend and SIEM detections and advised defenders to patch immediately and treat exposed vulnerable instances as potentially compromised.
A Wordfence-cited report said its firewall had blocked more than 11 million exploit attempts targeting the WordPress wp2shell chain. The attacks sought to chain CVE-2026-63030 and CVE-2026-60137 to create rogue administrator accounts on vulnerable sites, providing a new quantitative measure of the campaign's scale.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 25 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
50 references tracked. Mallory keeps watching after this page renders.
mbsd.jp
Open sourcetrustedsec.com
Open sourcegithub.com
Open sourcefortiguard.fortinet.com
Open sourceresearch.eye.security
Open sourcefortbridge.co.uk
Open sourcewordfence.com
Open sourcewp2shell.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
WordPress has released **7.0.3** as a security update to fix multiple vulnerabilities, led by a high-severity pre-authentication reflected XSS flaw in the login screen tracked as **`CVE-2026-64638`** and **`GHSA-52p2-r8wf-jcrf`**. The issue affects all WordPress versions and is being backported through the supported **4.7** security branch, while **7.1 RC2** also includes the fixes. WordPress said site owners should update immediately; versions older than 4.7 remain affected and are outside the current backport range.
Aug 19, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation, including two **WordPress Core** flaws that can be chained from SQL injection to unauthenticated remote code execution, the critical **Langflow** RCE `CVE-2026-0770`, and **DD-WRT** flaw `CVE-2021-27137`. The WordPress issues, `CVE-2026-60137` and `CVE-2026-63030`, affect default installations and have drawn warnings from CERT-FR and NCSC-NL because public proof-of-concept code is available and broader exploitation is considered likely or imminent. `CVE-2026-60137` stems from improper sanitization of the `author__not_in` parameter in `WP_Query` when plugins or themes pass untrusted input, affecting WordPress `6.8.x` before `6.8.6`, `6.9.x` before `6.9.5`, and `7.0.x` before `7.0.2`. Organizations were urged to prioritize patching those versions, update Langflow, and upgrade DD-WRT builds older than `45724`; where immediate WordPress patching is not possible, defenders were advised to restrict unauthenticated access to the REST batch API endpoint, including paths such as `/wp-json/batch/v1` or requests containing `rest_route=/batch/v1`.
Jul 25, 2026