- Two vulnerabilities (CVE-2026-63030 and CVE-2026-60137) chain into unauthenticated remote code execution on WordPress 6.9 and 7.0.
- WordPress forced automatic updates for affected sites, but public exploits and in-the-wild attacks have been confirmed.
- Cloudflare deployed WAF rules to block exploitation, while temporary mitigations include blocking the batch API endpoint.
- Over 500 million sites run WordPress, though the exposed population is limited to versions released after December 2025.
WordPress has been hit by a pair of critical security flaws that together allow an unauthenticated attacker to take full control of a site. The vulnerabilities, disclosed on July 17, 2026, have already seen public exploit code and active exploitation in the wild, forcing the WordPress team to push emergency updates. Both bugs are in core, so a default installation with no plugins is exploitable, making this one of the most serious WordPress security incidents in recent years.
The two flaws, tracked as CVE-2026-63030 and CVE-2026-60137, were discovered by Adam Kues at Searchlight Cyber and reported separately by TF1T, dtro, and haongo. They affect different parts of the request path but can be chained into a remote code execution (RCE) attack that requires no login or user interaction. The attack chain has been dubbed ‘wp2shell’ by the research team, and a checker tool was made available at wp2shell.com for site owners to test their exposure.
The Vulnerabilities: CVE-2026-63030 and CVE-2026-60137
The first vulnerability, CVE-2026-63030, is a REST API batch-route confusion issue introduced in WordPress 6.9. It lives in the /wp-json/batch/v1 endpoint, where an indexing mismatch during request validation can cause request objects and their permission checks to become misaligned. This confusion allows an attacker to bypass the endpoint’s allow-list and land crafted input in a vulnerable query. The second flaw, CVE-2026-60137, is a SQL injection in the author__not_in parameter of WP_Query. When a string is passed instead of an array, the check that expects an array is skipped, dropping the raw value into the database query. Chained together, an anonymous request can achieve full remote code execution on a stock WordPress install.
According to Cloudflare, the RCE path works only when the site is not using a persistent object cache like Redis or Memcached. Since a default WordPress installation has no such cache, the exposure is broad. The SQL injection alone is rated Critical with a CVSS score above 9.1, while the RCE chain carries a CVSS of 7.5 (High) but is treated as Critical by WordPress itself due to the unauthenticated attack vector.
Affected Versions and Patches
The full RCE chain affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. WordPress 6.8.0 through 6.8.5 is vulnerable only to the SQL injection, as the batch-route confusion was introduced in 6.9. Fixes have been released in versions 6.9.5, 7.0.2, and 6.8.6, with the beta of 7.1 also receiving a fix in beta2. Versions prior to 6.8 are not affected by either issue. WordPress enabled forced automatic updates for sites running affected versions, but administrators should verify the update landed in their dashboard. If auto-updates were turned off, the forced push may not have reached the site, so manual updating is strongly recommended.
Searchlight Cyber estimates that over 500 million websites run WordPress, but the exposed population is smaller because the RCE chain only exists in versions released after December 2, 2025. Cybersecurity consultant Daniel Card sampled around 3,500 sites and found less than 15% were still vulnerable, which would still translate to roughly 90 million sites at risk globally.
Mitigation and WAF Protections
Cloudflare deployed Web Application Firewall (WAF) rules for both vulnerabilities on July 17 at 17:03 UTC, covering all plans including free accounts as long as traffic is proxied through the WAF. The rules block attempts to exploit the SQL injection and the batch-route confusion with a default action of Block. Cloudflare warns that WAF protections are not a substitute for patching, but they reduce exposure while updates roll out. Customers on Pro, Business, or Enterprise plans should ensure Cloudflare Managed Rules are enabled; free users are automatically protected through the Free Ruleset.
For those who cannot update immediately, temporary mitigations include blocking the paths /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF level, or installing a plugin that disables anonymous REST API access. These measures can break legitimate integrations and should only be used as a stopgap until the patch is applied. Searchlight Cyber also published a drop-in plugin that rejects anonymous batch requests at the rest_pre_dispatch hook.
Exploitation in the Wild
Public proof-of-concept exploits appeared on GitHub within a day of the disclosure, and multiple cybersecurity firms have reported active exploitation. watchTowr CEO Benjamin Harris confirmed that his team is already seeing PoC exploits in circulation and the first signs of in-the-wild exploitation. Hexastrike’s head of CTI Maurice Fielenback noted on Monday that they continue to see attempted and successful wp2shell exploitation, and have compiled indicators of compromise. Patchstack and WatchTowr also issued warnings about active attacks.
Some PoCs combine the two vulnerabilities to extract WordPress password hashes via SQL injection, then crack an administrator password to upload a malicious plugin. Others claim to achieve pre-authentication RCE without needing credentials. Searchlight Cyber held back technical details initially to give defenders time to patch, but other researchers independently reproduced the chain after reading the public patch. The open-source nature of WordPress meant the fix itself revealed the bug’s location, accelerating exploit development.
Rapid7 has added unauthenticated vulnerability checks for InsightVM and Nexpose, scheduled for the July 20 content release. The flaws are not yet on CISA’s Known Exploited Vulnerabilities catalog, but that may change as exploitation ramps up. Mass exploitation of WordPress is a well-established pattern, and this incident follows a similar trajectory to previous critical flaws.
WordPress’s own security advisory rates the RCE chain as Critical, and the team has urged all site owners to update immediately. The forced auto-update system was activated, but administrators should not assume it worked. Checking the actual version running on your site is the only way to be sure. With public exploits available and attackers actively scanning, the window for patching is closing fast.
