NewsCompaniesFlawsGuides
Get the app
CriticalFixedBeing used in attacksClosedUpdated

WordPress Core "WP2Shell" flaws CVE-2026-63030 and CVE-2026-60137 let attackers run code without logging in

Two WordPress Core flaws, chained, let anyone run code on a site without logging in. CISA lists them as exploited. Fixed in WordPress 7.0.2, 6.9.5 and 6.8.6; check your site is on one of those, or ask whoever manages it.

What to do

If you run a WordPress site, update it now to 7.0.2, 6.9.5 or 6.8.6 (Dashboard, then Updates), or ask your web host or developer to confirm it is on one of those versions. Check the site for unfamiliar admin users or plugins if it ran an older version after 17 July.

What’s happening

Two flaws in WordPress Core, the software behind a large share of websites, can be chained so that an attacker who is not logged in can run their own code on the site. One is a SQL injection in how WordPress builds database queries (CVE-2026-60137). The other is a confusion in the REST API's batch endpoint (CVE-2026-63030) that gets around the restriction that otherwise limits the injection to logged-in users. WordPress released fixes on 17 July 2026: 7.0.2, 6.9.5 and 6.8.6, and said it was forcing updates on sites that support automatic updates. Versions before 6.8 are not affected. The full code-execution chain affects 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1; 6.8.0 to 6.8.5 is affected only by the SQL injection. The WordPress project's own release notice did not mention attacks, but New Zealand's NCSC reported active exploitation on 20 July and CISA listed both flaws as exploited on 21 July. Public proof-of-concept exploits are reported to exist. A fix is available for every supported version. Sites that did not update automatically remain exposed.

What
Flaw
Affects
WordPress Core (self-hosted WordPress websites)
Affected
WordPress 6.8.0 to 6.8.5 (CVE-2026-60137 only)
WordPress 6.9.0 to 6.9.4
WordPress 7.0.0 to 7.0.1
Fixed in
WordPress 6.8.6
WordPress 6.9.5
WordPress 7.0.2
WordPress 7.1 beta2
CVE
CVE-2026-60137, CVE-2026-63030
Since
17 July 2026
Closed
21 July 2026

Timeline

  1. CISA added

    CISA added both CVEs to its Known Exploited Vulnerabilities catalogue, with a federal patch deadline of 24 July 2026.

  2. Wider attacks

    New Zealand's NCSC warned that both flaws were under active exploitation and could be chained by an unauthenticated attacker to run code.

  3. Update

    WordPress published advisories for both flaws. The batch-route flaw is rated critical and, combined with the SQL injection, leads to remote code execution on 6.9 and 7.0. The SQL injection alone is rated moderate and also affects 6.8.

  4. Made publicFixed

    WordPress released 7.0.2, with backports 6.9.5 and 6.8.6, fixing a SQL injection (CVE-2026-60137) and a REST API batch-route confusion flaw (CVE-2026-63030). The project said it was forcing updates through auto-update on affected sites.

Sources

  1. WordPress 7.0.2 Security ReleaseWordPress.org · 17 July 2026
  2. REST API batch-route confusion and SQL injection leading to RCE (GHSA-ff9f-jf42-662q)WordPress (GitHub advisory) · 17 July 2026
  3. Facilitated SQL injection in WP_Query author__not_in (GHSA-fpp7-x2x2-2mjf)WordPress (GitHub advisory) · 17 July 2026
  4. CVE-2026-63030 and CVE-2026-60137 affecting WordPressNCSC New Zealand · 20 July 2026
  5. WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026-63030 & CVE-2026-60137)Qualys · 30 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from July 2026 · JSON · RSS