WordPress has issued urgent patches for two critical vulnerabilities, CVE-2026-60137 and CVE-2026-63030, which, when chained together, enable unauthenticated remote code execution (RCE). The patches were released late Friday, but by Saturday morning, widespread exploitation was already underway, with security researchers observing tens of thousands of exploitation attempts and over 100 backdoor accounts created by various threat actors.
CVE-2026-63030 is a critical REST API batch-route confusion bug, while CVE-2026-60137 is a moderate-severity SQL injection issue. The route confusion flaw causes WordPress to misalign internal arrays for sub-requests, validation results, and handlers, leading it to treat unvalidated requests as trusted. While individually difficult to exploit, their combination allows attackers to achieve RCE without prior authentication.
WordPress core developer John Blackbourn advised immediate updates for affected users and confirmed that the security team initiated forced updates via the auto-update system for vulnerable versions due to the severity of the flaws.
The vulnerabilities affect WordPress 6.9, which is fixed in version 6.9.5. WordPress 6.8 is only susceptible to the SQL injection flaw, with version 6.8.6 providing the fix. Additionally, WordPress 7.1 Beta 1 is vulnerable, and version 7.1 Beta 2 addresses both CVEs. Versions prior to 6.8 are not affected.
Adam Kues, a researcher at Searchlight Cyber, is credited with discovering and reporting CVE-2026-63030, which he dubbed "wp2shell." Kues stated that the attack has no preconditions and can be exploited by an anonymous user on a default WordPress installation without any plugins. Searchlight Cyber has released a free wp2shell checker for users to assess their instances.
Security firms began observing exploitation of both CVEs by Friday night. Researchers at watchTowr were able to reproduce CVE-2026-63030 within minutes of its disclosure, and CVE-2026-60137 with additional effort. They noted that the vulnerabilities could be reproduced with the assistance of frontier AI models.
Following the public release of exploit code, attackers initiated indiscriminate internet-wide scanning. WatchTowr's honeypots recorded numerous exploitation attempts, leading to the creation of backdoor administrator accounts. Attackers then deployed fake WordPress plugins to achieve RCE, exfiltrate credentials or secrets, or download further tools, including repeated attempts to install Overlord RAT, a Golang-based remote access trojan.
Organizations that delayed patching until Monday are likely already compromised. Defenders are urged to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, irrespective of whether they have applied the patches.
