Critical WordPress Core Vulnerability Actively Exploited in the Wild

Your WordPress site could be at serious risk right now. Regarding WordPress vulnerability, A critical security flaw discovered in WordPress Core is being actively exploited by attackers, and it could give someone complete control of your website without needing any login credentials.

Here’s what you need to know and what to do about it.

What Happened: A Serious Security Flaw

On July 17, 2026, security researchers revealed CVE-2026-63030, a critical vulnerability in WordPress itself. This isn’t a plugin problem or a theme issue. This affects the core WordPress software that powers your entire site.

The vulnerability allows hackers to execute code on your site remotely through the WordPress REST API batch endpoint. They don’t need a username, password, or any interaction from you. They just need your site to be running an affected version of WordPress.

According to Searchlight Cyber, the researchers who found the flaw, attackers can exploit this on a completely default WordPress installation. You don’t need any additional plugins for your site to be vulnerable.

Which WordPress Versions Are Affected

This vulnerability impacts specific WordPress versions. If you’re running any of these, your site is at risk:

WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1 are confirmed vulnerable. However, if you’re running an older version before 6.9, you’re not affected by this particular vulnerability.

The good news is that WordPress has released fixes. You need to update to WordPress 6.9.5, 7.0.2, or the latest version available for your branch.

Why This Matters to Your Business

This isn’t just technical noise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to their Known Exploited Vulnerabilities catalog on July 21. That means attackers are actively using this flaw to break into WordPress sites right now.

When someone exploits this vulnerability, they can take complete control of your website. They can steal customer data, deface your site, install malware, or use your server to attack other websites. For a business, that means potential data breaches, lost revenue, damaged reputation, and possible legal liability.

Cloudflare reported that sites without persistent object caching are particularly vulnerable. Additionally, public proof-of-concept exploits are now available online, which means even less-skilled attackers can target your site.

How the Attack Works

The technical details reveal why this is so dangerous. CVE-2026-63030 exploits a logic flaw in how WordPress processes batch API requests. When combined with a second vulnerability (CVE-2026-60137), a SQL injection issue, attackers can chain these together to gain administrator access.

Here’s the scary part: neither vulnerability alone would be catastrophic. However, when used together, they create a path for attackers to create an admin account, log in, and upload malicious code to your site.

The batch API processes requests in two separate loops for validation and execution. When a parsing error occurs, these loops become desynchronized. That desynchronization allows attackers to bypass security checks that would normally protect you.

What You Need to Do Right Now

Update your WordPress site immediately. This is not something you can put off until next week or next month. Log into your WordPress dashboard and check your version number.

WordPress is forcing automatic updates for sites that have that feature enabled. However, you should verify the update happened successfully. Don’t assume it worked without checking.

If you’re on WordPress 6.9, update to 6.9.5 or later. If you’re on WordPress 7.0, update to 7.0.2 or later. If you’re running a beta version of 7.1, make sure you’re on Beta 2 or later.

If You Can’t Update Immediately

Sometimes you can’t update right away because of compatibility concerns or other technical constraints. In that case, you need temporary protection while you plan your update.

You can block access to the vulnerable endpoint at your web application firewall. Specifically, block requests to /wp-json/batch/v1 or requests with ?rest_route=/batch/v1 in the URL. Alternatively, you can use a security plugin to disable anonymous REST API access entirely.

These are temporary measures only. You still need to update as soon as possible. Blocking the endpoint reduces your risk, but it doesn’t eliminate it completely.

Check If Your Site Was Already Compromised

Because attackers have been actively exploiting this vulnerability, you need to investigate whether your site was already targeted. Updating fixes the vulnerability, but it doesn’t remove malicious code that might already be there.

Rapid7, the security firm that analyzed this vulnerability, strongly recommends checking your site for signs of compromise even after patching. Review your HTTP access logs for unusual requests to the batch endpoint. Look for unfamiliar plugins or PHP files that you didn’t install.

If you find anything suspicious or you’re not sure what to look for, contact a WordPress security professional. The cost of professional help is much less than the cost of a successful attack.

This Affects Everyone Using WordPress

WordPress powers a significant portion of the internet. That makes vulnerabilities in WordPress Core particularly serious. When millions of sites run the same software, a single flaw creates millions of potential targets.

Attackers know this. They’re actively scanning the internet for vulnerable WordPress installations right now. Every hour you delay updating is another hour your site remains exposed.

This is exactly why keeping WordPress updated matters so much. Security updates aren’t optional maintenance tasks. They’re essential protection for your business and your customers’ data.

Moving Forward: Prevention Matters

Once you’ve updated and verified your site is secure, think about how to prevent this situation in the future. Consider enabling automatic updates for WordPress Core. Yes, there’s a small risk of compatibility issues, but that risk is far smaller than the risk of running vulnerable software.

If you manage multiple WordPress sites, audit all of them. This vulnerability affects WordPress Core, which means every site you manage could be at risk. Don’t assume anything. Check each one individually.

Consider working with a managed WordPress hosting provider or a WordPress maintenance service. They monitor for security updates and apply them quickly, often before you even hear about the vulnerability. For busy business owners, that peace of mind is worth the investment.

The bottom line is simple: update your WordPress site now. Check that the update completed successfully. Then verify your site wasn’t already compromised. This is one of those situations where taking action today prevents a disaster tomorrow.

Original Source: www.rapid7.com