Loading story…
WordPress released security updates for two core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to remote code execution. The issue, dubbed wp2shell, stems from REST API batch-route confusion in the /wp-json/batch/v1 endpoint combined with SQL injection, affecting WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. Researchers said the route-confusion flaw carries a CVSS 9.8 rating, while the second SQL injection bug is rated CVSS 5.9.
WordPress fixed the flaws in 6.9.5 and 7.0.2, and also backported the SQL injection fix to 6.8.6. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On July 21, 2026, ISA added CVE-2026-63030 to its Known Exploited Vulnerabilities Catalog after in-the-wild exploitation of the WP2Shell chain was confirmed. The listing accelerated remediation requirements for U.S. federal agencies.
As of 17 July, no active exploitation of the WordPress vulnerabilities had been confirmed. Researchers warned, however, that public patch diffs could quickly enable proof-of-concept exploit development.
A public proof of concept became available showing how CVE-2026-60137 and CVE-2026-63030 could be chained for unauthenticated exploitation. The PoC demonstrated a path to sensitive database extraction and, in some conditions, arbitrary code execution.
WordPress released fixes for the affected branches, patching CVE-2026-63030 in versions 6.9.5 and 7.0.2 and addressing CVE-2026-60137 with backports including 6.8.6. The vulnerabilities affected WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
Adam Kues of Assetnote discovered the WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137 through the WordPress HackerOne program. The flaws could be chained to make a blind SQL injection remotely reachable without authentication and potentially lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
fortiguard.fortinet.com
Open sourcethecyberexpress.com
Open sourceboho.or.kr
Open sourceacn.gov.it
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Jul 30, 2026
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation, including two **WordPress Core** flaws that can be chained from SQL injection to unauthenticated remote code execution, the critical **Langflow** RCE `CVE-2026-0770`, and **DD-WRT** flaw `CVE-2021-27137`. The WordPress issues, `CVE-2026-60137` and `CVE-2026-63030`, affect default installations and have drawn warnings from CERT-FR and NCSC-NL because public proof-of-concept code is available and broader exploitation is considered likely or imminent. `CVE-2026-60137` stems from improper sanitization of the `author__not_in` parameter in `WP_Query` when plugins or themes pass untrusted input, affecting WordPress `6.8.x` before `6.8.6`, `6.9.x` before `6.9.5`, and `7.0.x` before `7.0.2`. Organizations were urged to prioritize patching those versions, update Langflow, and upgrade DD-WRT builds older than `45724`; where immediate WordPress patching is not possible, defenders were advised to restrict unauthenticated access to the REST batch API endpoint, including paths such as `/wp-json/batch/v1` or requests containing `rest_route=/batch/v1`.
Jul 25, 2026
Attackers targeted multiple widely used WordPress plugins with critical flaws that enabled site takeover, malware deployment, and remote code execution. The most prominent issue, `CVE-2024-27956` in **WP-Automatic** before version `3.9.2.0`, was exploited through SQL injection to bypass authentication, create rogue administrator accounts, upload malicious files, and fully compromise websites; defenders were told to watch for suspicious admin usernames beginning with `xtw`, renamed WP-Automatic files, and known malicious file hashes. CSIRT.SK also reported more than **5.5 million** exploitation attempts across several WordPress plugin vulnerabilities, including `CVE-2024-27956`, `CVE-2024-2876`, `CVE-2024-2417`, and `CVE-2024-28890`. Separate advisories warned that **Forminator** versions earlier than `1.29.3` contained a critical unrestricted file upload flaw, `CVE-2024-28890`, that could let remote attackers execute code on the server, alongside `CVE-2024-31077` and `CVE-2024-31857`, which exposed sites to SQL injection and cross-site scripting. CSIRT.SK also flagged **Poll Maker** before version `3.4` for `CVE-2024-32514`, an arbitrary file upload vulnerability that could lead to remote code execution. The combined disclosures showed active attacker focus on vulnerable WordPress plugins as an initial access path, prompting urgent patching and compromise checks across exposed sites.
Jul 24, 2026