WordPress: critical core chain (wp2shell), CVE-2026-60137 and CVE-2026-63030

Critical vulnerability chain in the WordPress core, exploitable without authentication. Update now and verify every site.

On 17 July 2026 WordPress released fixes for a chain of critical vulnerabilities in its core, allowing remote code execution without authentication. The chain consists of two flaws, CVE-2026-60137 and CVE-2026-63030: a routing confusion in the REST API batch route and a SQL injection in the core. It does not depend on plugins or themes.

Versions 6.9.x and 7.0.x are affected by the full chain; 6.8.x only by the SQL injection. The fixed versions are 6.8.6, 6.9.5 and 7.0.2. Forced automatic updates were enabled for affected versions, but this alone does not prove that a site is clean.

Several security firms report active exploitation, and CISA has added both CVEs to the KEV catalogue. Webshells and malicious plugins have been observed on compromised sites.

Check the real version of every site, including staging and installations no longer in use. After updating, review files, administrator accounts and recently installed plugins.

At a glance

What: A chain of vulnerabilities in the WordPress core that allows remote code execution without authentication. It does not depend on plugins or themes.
Components: Two flaws: a routing confusion in the REST API batch route and a SQL injection in the core.
Affected versions: 6.9.x and 7.0.x are affected by the full chain; 6.8.x only by the SQL injection. Another source gives 6.9 to 6.9.4 and 7.0 to 7.0.1: compare with your own version.
Fix: Fixed versions 6.8.6, 6.9.5 and 7.0.2, released on 17 July 2026. Forced automatic updates were enabled for affected versions.
Status: Active exploitation reported by several security firms. CISA has added both CVEs to the KEV catalogue. Webshells and malicious plugins have been observed on compromised sites.
Action: Check the real version of every site, including staging and legacy installations. Updating alone does not prove a site is clean: check files and users too.

Sources: Wordfence, wp2shell aftermath · INCIBE-CERT, chain of critical vulnerabilities in WordPress

← All articles