Loading story…
WordPress released 7.1.1, a maintenance and security update that remediates 11 vulnerabilities alongside 17 Core and 19 Block Editor bugs. The flaws include stored cross-site scripting, authorization weaknesses and bypasses, authenticated path traversal, arbitrary post overwrite, private-information disclosure, unauthorized comment reparenting, XML-RPC capability-check bypasses, and unauthorized installation or previewing of inactive WordPress.org themes through crafted URLs. Specific fixes also address script injection via wpautop(), custom-header theme XSS, and HTML API comment-context escaping.
Administrators should update production sites to WordPress 7.1.1 immediately; sites configured for automatic background updates are expected to receive the release automatically. Applicable fixes are being backported to supported WordPress security branches through version 4.7. Tenable published a Nessus detection plugin for installations from WordPress 7.0.0 through versions before 7.1.1, although its metadata reported no known public exploits.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
WordPress released version 7.1.1, fixing 11 security vulnerabilities as well as 17 Core bugs and 19 Block Editor bugs. The fixes include stored XSS, authorization flaws, authenticated path traversal, arbitrary post overwrite, information disclosure, and unauthorized comment reparenting; WordPress urged administrators to update immediately and said applicable fixes would be backported through supported branch 4.7.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcewordpress.org
Open sourcetenable.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress has released **7.0.3** as a security update to fix multiple vulnerabilities, led by a high-severity pre-authentication reflected XSS flaw in the login screen tracked as **`CVE-2026-64638`** and **`GHSA-52p2-r8wf-jcrf`**. The issue affects all WordPress versions and is being backported through the supported **4.7** security branch, while **7.1 RC2** also includes the fixes. WordPress said site owners should update immediately; versions older than 4.7 remain affected and are outside the current backport range.
Aug 19, 2026
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026