WordPress Critical: RCE flaw mass-exploited within hours

What happened?

On Friday, July 20, 2026, WordPress released security patches for two critical vulnerabilities: CVE-2026-63030 (CVSS score 9.8, critical) and CVE-2026-60137 (moderate severity, SQL injection). The first, dubbed wp2shell by researcher Adam Kues of Searchlight Cyber, is a path confusion flaw in the REST API that, combined with the SQL injection, allows an unauthenticated attacker to execute arbitrary code on the server. Within hours, exploits became public and attacks skyrocketed. According to Jake Knott, lead researcher at watchTowr, his team reproduced CVE-2026-63030 within minutes of disclosure, and the second vulnerability required additional effort. By Saturday morning, successful exploitation was in full swing, initially using public exploit code to exfiltrate hashed credentials, followed by remote code execution.

Why is this important?

The severity lies in the fact that exploitation requires no prerequisites: it works on clean WordPress installations without additional plugins. Knott confirmed to The Register that from their perspective across a global customer base, they are seeing widespread impact across organizations of all sizes and sectors. Affected versions are WordPress 6.9 (both vulnerabilities) and 6.8 (SQLi only). WordPress 6.9.5 and 6.8.6 fix the flaws. Beta 7.1 is also vulnerable, while versions prior to 6.8 are not affected. John Blackbourn, lead WordPress developer, recommended updating sites immediately. The WordPress security team activated forced automatic updates for affected sites, but many administrators may have updates disabled or environments that delay patches.

Consequences and observations

watchTowr's honeypots recorded tens of thousands of exploitation attempts and over 100 admin accounts created by different actors. Attackers deployed fake plugins to maintain access, exfiltrate credentials, and download additional tools, such as the Overlord RAT trojan. VulnCheck verified more than two dozen distinct proof-of-concept exploits in just 48 hours. Knott highlighted that once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens. This marks a growing trend: AI accelerates exploit creation, reducing the time between patch and mass exploitation.

What should readers know?

• Update immediately: If you use WordPress 6.9 or 6.8, apply patches 6.9.5 or 6.8.6 without delay.
• Review admin accounts: Look for unknown users with administrator role and remove them.
• Security scanning: Use tools like Searchlight Cyber's free checker (wp2shell checker) to detect if your site is vulnerable.
• Log monitoring: Check server logs for exploitation patterns, especially unusual requests to the REST API.
• Backups and contingency plan: Ensure recent backups and have a plan to restore from a clean backup if needed.

Context and reflection

This incident recalls the massive attack against the wp-config.php plugin in 2024, but with potentially greater scope as it affects the WordPress core. The speed of exploitation (hours after the patch) underscores the need to apply security updates immediately, especially on critical systems. The involvement of AI in exploit generation is a growing trend that security teams must anticipate. According to Knott, the ease with which attackers can use AI to create functional exploits from technical descriptions changes the threat landscape. Companies should adopt automated patching and continuous monitoring to mitigate risks.

Additionally, the path confusion flaw in the REST API, explained by researchers at Hacktron, causes arrays containing sub-requests, validation results, and matching handlers to become misaligned, making WordPress treat all requests as trusted. Individually, the bugs are hard to exploit, but chained they allow unauthenticated RCE. This type of vulnerability is particularly dangerous because it attacks the CMS core, affecting millions of sites. WordPress's response with forced updates is a positive step, but the responsibility falls on administrators to ensure their systems are protected.