Overview
- WordPress pushed emergency fixes and enabled forced automatic updates on Friday, July 17, after researchers disclosed two critical bugs tracked as CVE-2026-63030 and CVE-2026-60137.
- The exploit chain uses a REST API route‑confusion entry (batch endpoint) to bypass authentication and a faulty author__not_in handling in WP_Query to trigger unauthenticated SQL injection, which attackers chain into remote code execution dubbed WP2Shell.
- Public proof‑of‑concept code and automated exploit tools were published within hours, and security firms report ongoing large‑scale attacks that have generated tens of thousands of hit attempts and dozens of created backdoor admin accounts.
- Site owners should update immediately to WordPress 6.9.5 or 7.0.2, inspect for new administrator users or malicious plugins, and apply short‑term mitigations such as blocking the batch REST endpoints or deploying WAF rules.
- Because WordPress runs roughly 40–43% of websites, even a small unpatched share represents millions of targets, which raises the risk of site takeovers, credential theft, and distribution of remote access trojans to affected users and businesses.