~/f4n6 $ grep -r "Two new high severity WordPress vulnerabilities, patch immediately!" ./investigations/ --include="*.md"

Two new high severity WordPress vulnerabilities, patch immediately!

Jeff Davies 19 Jul 2026 6 min read

1. Executive summary

WordPress Core versions 6.8 through 7.0.1 are affected by two vulnerabilities patched in the 7.0.2 security release: CVE-2026-63030, an unauthenticated remote code execution flaw via the REST API batch endpoint (CVSS 7.5, not in CISA KEV), and CVE-2026-60137, a SQL injection issue (CVSS 5.9 MEDIUM, not in CISA KEV, EPSS 4%). Public proof-of-concept exploits for CVE-2026-63030 have been released, and the vulnerability affects default installations without requiring plugins or authentication. EMEA financial services running internet-facing WordPress sites for customer portals, marketing, or internal services face potential complete server compromise, data exfiltration, and downstream lateral movement risk.

2. Regulatory framing

Article Trigger (the fact in this item) Practical impact
DORA Art. 24: digital operational resilience testing — general requirements Public PoC exploits exist for an unauthenticated RCE in a widely deployed CMS component; affected versions are identifiable and testable Clients must verify WordPress version inventory against affected ranges and confirm patch application as part of operational resilience testing
DORA Art. 19: reporting of major ICT-related incidents to competent authorities Unauthenticated RCE on internet-facing systems can lead to complete compromise of web infrastructure and underlying data If exploitation is confirmed, clients must assess whether the incident meets the classification threshold for a major ICT-related incident and report accordingly

3. Technical analysis & attack chain

CVE-2026-63030 — REST API batch-route confusion leading to SQL injection and RCE ("wp2shell")

  • CVSS: 7.5 (per verified reference data). Note: the GitHub Security Advisory classifies severity as Critical, and Rapid7's headline refers to it as "critical" — this discrepancy reflects the advisory label versus the assigned CVSS score. The verified CVSS is 7.5.
  • CISA KEV: Not listed.
  • Affected versions: WordPress 6.9.0–6.9.4, 7.0.0–7.0.1, and affected 7.1 beta versions. WordPress 6.8.x is NOT affected by this CVE. Versions prior to 6.8 are not affected.
  • Fixed versions: WordPress 6.9.5, 7.0.2, 7.1 Beta 2.
  • Reporter: Adam Kues at Assetnote / Searchlight Cyber.

Attack chain (confirmed steps)

  1. Initial access — unauthenticated REST API interaction. The attacker sends crafted requests to the WordPress REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1). No valid account credentials or user interaction are required. The vulnerability is exploitable against a default WordPress installation without additional plugins.
  2. Batch-route confusion. The batch endpoint processes multiple REST API routes in a single request. A logic flaw in route handling within the batch processing allows an attacker to confuse the routing mechanism, causing the application to execute SQL queries in an unintended context.
  3. SQL injection. The route confusion enables injection of malicious SQL via the batch request payload. The SQL injection is the mechanism by which the attacker manipulates the database layer.
  4. Remote code execution. The SQL injection is leveraged to achieve remote code execution on the underlying server, resulting in potential complete compromise of the website and its data.

Key technical notes

  • Cloudflare reported that the vulnerable code path can be reached when a persistent object cache is not in use. This is a significant configuration dependency — sites running a persistent object cache (e.g., Redis, Memcached) may not be reachable via this specific code path, though this has not been confirmed as a complete mitigation.
  • Searchlight Cyber had not published full technical exploit details as of July 17, 5:45 PM Eastern time. However, BleepingComputer reports that public exploits have been released, increasing urgency.
  • Rapid7 Labs assesses it as highly likely that additional public PoCs will appear rapidly given WordPress Core is open-source and AI models can analyse the code diff.

CVE-2026-60137 — Facilitated SQL injection

  • CVSS: 5.9 MEDIUM (per verified reference data). Note: the Help Net Security headline labels this as "high severity" — the verified CVSS is 5.9 MEDIUM. This discrepancy is noted; the verified classification governs.
  • CISA KEV: Not listed. EPSS: 4%.
  • CWE: CWE-89 (SQL Injection).
  • Affected versions: WordPress 6.8.x and 6.9.x. Version 6.8 is affected by this vulnerability but NOT by CVE-2026-63030.
  • Fixed versions: WordPress 6.8.6 (for 6.8 branch), 6.9.5 (for 6.9 branch), 7.0.2 (for 7.0 branch), 7.1 Beta 2.
  • Reporters: TF1T, dtro, and haongo (reported as a team).
  • Technical detail: The source material describes this as a "facilitated SQL injection issue" but does not provide further technical specifics on the mechanism, attack vector, or preconditions. No additional technical detail is available in the provided sources.

Confidence caveat: CVE-2026-63030 technical details are corroborated across Help Net Security, Rapid7, and BleepingComputer. The existence of public exploits is single-sourced to BleepingComputer — verify before enforcement. CVE-2026-60137 details are thin and single-sourced to the Help Net Security summary; no independent technical corroboration is available in the provided material.

4. Mitigation & containment

P1 — Within 24 hours

  1. Inventory and prioritise. Identify all internet-facing and internal WordPress installations. Determine versions. Priority: any site running 6.9.0–6.9.4 or 7.0.0–7.0.1 (vulnerable to CVE-2026-63030 RCE).
  2. Patch to fixed versions immediately: - WordPress 6.9 branch → upgrade to 6.9.5 - WordPress 7.0 branch → upgrade to 7.0.2 - WordPress 7.1 beta → upgrade to 7.1 Beta 2 - WordPress 6.8 branch → upgrade to 6.8.6 (CVE-2026-60137 only)
  3. Verify auto-updates succeeded. WordPress maintainers are forcing updates for affected installations with automatic updates enabled. Administrators must not assume this succeeded — manually verify each internet-facing site reports the fixed version.
  4. If immediate patching is not possible, apply emergency temporary WAF mitigation: - Block anonymous access to /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF/reverse proxy level. - Alternatively, install a plugin that blocks anonymous access to the REST API entirely. - Warning: Both approaches may impact legitimate site functionality. These are emergency measures only, not substitutes for patching.

P2 — Within 72 hours

  1. Patch remaining 6.8.x sites to 6.8.6 for CVE-2026-60137 (SQL injection, CVSS 5.9).
  2. Audit for compromise. On any site that was running an affected version and is internet-facing, check for: - Unexpected files in the WordPress root, wp-content/uploads/, or wp-content/plugins/ (particularly PHP files). - Unauthorised administrator accounts in the wp_users table. - Modified core files against a known-good checksum. - Web server access logs for anomalous POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1.
  3. Enable persistent object cache (Redis or Memcached) if not already in use — this reduces the reachable attack surface for CVE-2026-63030 per Cloudflare's observation, though it is not a substitute for patching.

P3 — Within 7 days

  1. Confirm all WordPress instances across the estate are on fixed versions via automated scanning (e.g., Rapid7 InsightVM/Nexpose authenticated checks available in the July 20, 2026 content release).
  2. Review WAF rules to ensure REST API batch endpoint access is restricted to legitimate use cases going forward.
  3. Validate backup integrity for any compromised or potentially compromised sites.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour Where to observe Confidence
Unauthenticated POST requests to /wp-json/batch/v1 or ?rest_route=/batch/v1 containing SQL syntax or unexpected route parameters Web server access logs, WAF logs, SIEM Medium — based on confirmed attack vector
Unexpected PHP files appearing in wp-content/uploads/ or WordPress root directory File integrity monitoring, EDR, filesystem audit Medium — RCE outcome implies file creation capability
Anomalous batch API requests from external IPs when persistent object cache is not configured WAF logs, web server logs Medium — Cloudflare confirmed code path dependency

6. Detection

Insufficient indicators to author detection rules.

The sources do not contain specific malicious strings, file hashes, mutex names, registry keys, or other threat artefacts that would enable a reliable YARA or Sigma rule. The behavioural indicators in §5 should be implemented as log-based detection queries in the SIEM using the endpoint paths noted.

CVE assessment

1 referenced CVE

CVE CVSS Exploited EPSS Summary
CVE-2026-60137 5.9 Medium — 4% WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in paramete…

7. Sources

  • Help Net Security — "Two new high severity WordPress vulnerabilities, patch immediately!" — https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/ — 2026-07-18
  • Rapid7 Blog — "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core" — https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core — 2026-07-17
  • BleepingComputer — "WordPress Core 'wp2shell' RCE flaws get public exploits, patch now" — https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/ — 2026-07-18 (date inferred from context)

8. Adverse Trace position

CVE-2026-63030 presents a genuine high-priority risk to EMEA financial services: unauthenticated RCE on default WordPress installations with public exploits available. The CVSS of 7.5 (verified) is lower than the "Critical" label used in some reporting, but the practical impact — complete server compromise from an unauthenticated network request — justifies P1 urgency regardless of score. CVE-2026-60137 (CVSS 5.9 MEDIUM) is lower risk but still requires patching as part of the same release cycle. Neither CVE is currently in CISA KEV, and no confirmed in-the-wild exploitation has been reported by Rapid7 as of July 17; however, the existence of public PoCs (single-sourced to BleepingComputer — verify before enforcement) significantly raises the probability of opportunistic exploitation. Attribution is not relevant to this item — no named threat actor is involved. Adverse Trace will monitor for CISA KEV addition, confirmed wild exploitation, and emergence of IOCs, and will issue an update if the threat landscape changes materially.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.

Post this to LinkedIn
Formatting is converted automatically — headings, bullets, a link back & hashtags. Paste straight in.
J
Jeff Davies