Critical WordPress Vulnerabilities Demand Immediate Updates Now

WordPress just released version 7.0.2 to fix two serious security problems. If you’re running WordPress 6.9 or the 7.1 beta, you need to update right now. Attackers are already exploiting these vulnerabilities in the wild.

The WordPress security team identified two major flaws that could let hackers take control of your website. One involves SQL injection, and the other combines REST API confusion with SQL injection to enable remote code execution. Both are being actively exploited.

What These WordPress Vulnerabilities Mean for Your Site

Security researchers found two distinct problems. The first vulnerability, CVE-2026-60137, is a facilitated SQL injection issue. A team of researchers including TF1T, dtro, and haongo discovered this flaw. SQL injection attacks let hackers manipulate your database and potentially access sensitive information.

The second vulnerability, CVE-2026-63030, is more dangerous. Adam Kues at Assetnote and Searchlight Cyber found this REST API batch-route confusion issue. It combines with SQL injection to allow remote code execution. That means attackers could run their own code on your server and take complete control of your site.

These aren’t theoretical threats. VulnCheck verified more than two dozen unique exploits targeting these vulnerabilities as of Sunday, July 19. Attackers started compromising vulnerable WordPress installations late Friday evening. They’re deploying webshells and creating backdoor admin accounts to maintain access.

Which WordPress Versions Need Updates

WordPress 6.9 is affected by both vulnerabilities. You need to update to version 6.9.5 immediately. This release contains fixes for both security issues.

WordPress 6.8 is only vulnerable to the first issue, CVE-2026-60137. Update to version 6.8.6 to protect your site. If you’re running the beta release of WordPress 7.1, update to version 7.1 beta2 right away.

There’s some good news for sites running older versions. WordPress installations prior to version 6.8 are not affected by these vulnerabilities. However, running outdated WordPress versions exposes you to other security risks.

Emergency Protection If You Cannot Update Yet

Sometimes you cannot update WordPress immediately. Maybe you need to test the update on a staging site first, or you’re waiting for your developer. Searchlight Cyber researchers suggest temporary protection measures you can use in the meantime.

You can block anonymous access to the batch API in two ways. First, install a plugin that blocks anonymous access to the REST API entirely. Second, block specific endpoints at your web application firewall level: /wp-json/batch/v1 and ?rest_route=/batch/v1.

Keep in mind these are emergency measures only. Both solutions may interfere with legitimate site functionality. Your contact forms, mobile apps, or other features might stop working properly. Update WordPress as soon as possible rather than relying on these workarounds.

How Hackers Found and Exploited These Flaws

Adam Kues from Searchlight Cyber explained his discovery process on July 20. He used GPT5.6 Sol Ultra, an AI tool, to unearth CVE-2026-63030 and create a working exploit. This shows how rapidly security research is evolving with AI assistance.

Searchlight Cyber held off publishing details about the vulnerability initially. They wanted to give website owners a weekend to update their WordPress installations. During that time, researchers Calif and Hacktron independently reproduced the full exploit chain before other proof-of-concept code appeared on GitHub.

Maurice Fielenback, head of Cyber Threat Intelligence at Hexastrike, flagged initial exploitation attempts on Sunday. By Monday, they were seeing both attempted and successful attacks using what’s being called the “wp2shell” exploit. Hexastrike has already handled several confirmed and suspected incidents.

What Security Teams Are Seeing Right Now

Hexastrike compiled indicators of compromise based on active attacks. They’ve also published recommended incident response steps if you suspect your site has been compromised. The security community is treating this as an active threat requiring immediate attention.

VulnCheck’s analysis confirms the severity of the situation. With more than two dozen unique exploit variants verified, attackers have multiple ways to compromise vulnerable sites. Different exploit approaches mean automated security tools might miss some attack attempts.

The attackers aren’t just breaking in. They’re establishing persistence through webshells and backdoor admin accounts. Even if you update WordPress after being compromised, these backdoors could let hackers maintain access to your site.

What You Need to Do Right Now

Check your WordPress version immediately. Log into your WordPress dashboard and look at the footer or go to Dashboard > Updates. If you’re running version 6.9, 6.8, or the 7.1 beta, update to the latest patched version today.

Your hosting provider might have already updated WordPress for you if you have automatic updates enabled. Check anyway to be certain. If you manage multiple WordPress sites, prioritize sites with user accounts or sensitive data.

After updating, review your user accounts. Look for any admin-level accounts you don’t recognize. Check your file system for unusual PHP files, especially in your uploads directory. If you find anything suspicious, contact a WordPress security professional immediately.

If you have a WordPress care plan with a managed service provider, they should be handling this update for you. Reach out to confirm they’ve applied the security patches. This is exactly the kind of critical maintenance your care plan should cover automatically.

Original Source: www.helpnetsecurity.com