WordPress forces updates after chained bugs trigger RCE attacks
Two patched WordPress flaws are being exploited together, with researchers reporting credential theft, backdoor admin accounts and fake plugin deployment.
By Renata Fuchs · Policy Reporter
· 3 min read
WordPress has shipped fixes and enabled forced updates for two vulnerabilities that researchers say attackers are already chaining for unauthenticated remote code execution. The bugs affect current WordPress 6.9 releases and the WordPress 7.1 beta line, putting a large slice of the CMS market on a short remediation clock.
The two issues are CVE-2026-60137, a moderate-severity SQL injection flaw, and CVE-2026-63030, a critical REST API batch-route confusion vulnerability. On their own, researchers described the bugs as hard to exploit. Used together, they can allow an attacker with no account on the site to run code on a vulnerable WordPress installation.
What was fixed
WordPress released patches late Friday. WordPress 6.9 is affected by both vulnerabilities, and WordPress 6.9.5 fixes both. WordPress 6.8 is affected only by the SQL injection issue, with a fix in 6.8.6. WordPress 7.1 Beta 1 is also vulnerable, and Beta 2 addresses both CVEs. WordPress versions before 6.8 are not affected, according to the disclosure.
John Blackbourn, a WordPress core developer, told affected users to update immediately. He also said the WordPress security team turned on forced updates through the auto-update system for sites running impacted versions, a step reserved for cases where the project considers the exposure severe enough to justify intervention.
Hacktron researchers said the REST API bug causes WordPress to mix up arrays tracking sub-requests, validation results and matched handlers. That mismatch can make the application treat requests as if they have passed checks that should have blocked them.
WordPress credited Searchlight Cyber researcher Adam Kues with finding and reporting CVE-2026-63030. Kues later referred to the issue as wp2shell and said it can be exploited anonymously against a default WordPress installation without plugins. Searchlight Cyber also released a free checker for identifying vulnerable instances.
Exploitation moved quickly
PatchStack reported exploitation of both CVEs by Friday night, though it did not detail the activity. VulnCheck said its research team found more than two dozen distinct proof-of-concept exploits for wp2shell by Sunday after examining the patches.
Jake Knott, principal security researcher at watchTowr, said attackers moved from public exploit code into active compromise within hours. According to Knott, early activity focused on stealing hashed credentials, followed by remote code execution once more technical detail became available.
Knott also said watchTowr could reproduce CVE-2026-63030 within minutes after disclosure using frontier AI models, while reproducing CVE-2026-60137 required more effort. That claim does not prove attackers used AI, but it reflects a growing operational problem for defenders: patch diffs and public advisories can be converted into working exploits quickly.
WatchTowr said its honeypots logged tens of thousands of exploitation attempts and more than 100 backdoor administrator accounts created by different threat actors using variants of public tooling. After gaining admin access, attackers were seen installing fake WordPress plugins to run code, steal credentials or secrets, or fetch additional tools. Knott said one actor repeatedly tried to download Overlord RAT, a Golang-based remote access trojan.
For operators, applying the update may not be enough if the site was exposed over the weekend. Knott said organizations that delayed patching until Monday are likely to have been compromised and should check for newly created administrator accounts, malicious plugins and suspicious files even after updating.
This story draws on original reporting from The Register.
