Critical WordPress Core Flaw Under Active Attack — Update Now
A newly disclosed WordPress core security flaw is letting attackers seize control of vulnerable sites without needing any login credentials at all. Anyone running an affected version should patch immediately and check their site for signs of tampering.
The danger comes from two separate bugs that, when used together, let an outsider slip past input checks, run a SQL injection attack, plant a fake admin account, and push malicious code onto the server.
WordPress shipped fixes for the impacted branches on July 17, 2026, and real-world attacks began almost immediately, so anyone still on an older build needs to act fast — both to patch and to look for evidence their site was already hit.
Table of Contents
- What’s Actually Wrong With WordPress Core?
- Which Versions Are Exposed?
- Are Attackers Already Exploiting This?
- What Should Site Owners Do Right Now?
- How Prime Technologies Customers Can Stay Safer
- Quick Answers
What’s Actually Wrong With WordPress Core?
Two distinct flaws in WordPress core form the attack chain:
- CVE-2026-60137 — a SQL injection bug tied to
WP_Query. - CVE-2026-63030 — a routing mix-up in the WordPress REST API’s batch endpoint that confuses which handler processes a request.
Chained together, these let someone with zero credentials sidestep normal safeguards and reach database operations they should never be able to touch.
From there, the attacker can typically spin up a rogue administrator account and execute code remotely — effectively handing them the keys to the site. That access can be used to drop in malicious plugins, tamper with files, redirect site visitors elsewhere, or quietly plant a backdoor for later.
Which Versions Are Exposed?
- The SQL injection issue hits WordPress 6.8 through 7.0.1.
- The REST API routing issue hits WordPress 6.9 through 7.0.1.
Patches landed in:
- WordPress 7.0.2
- WordPress 6.9.5
- WordPress 6.8.6
Older, unsupported versions may dodge these two specific CVEs, but they’re almost certainly carrying other unpatched holes. Staying on a current, fully updated release is still the safest bet.
Are Attackers Already Exploiting This?
Yes — and quickly. Security firm Patchstack observed the earliest exploitation attempts roughly an hour and a half after version 7.0.2 went live.
In the days that followed, Patchstack’s systems blocked more than 65,000 attack attempts coming from over 1,500 distinct IP addresses, all aimed at sites still running the vulnerable code.
Roughly 97% of those blocked requests went after the REST API batch endpoint specifically, with attackers rotating through different URL formats and disguising their SQL injection payloads to dodge basic filters.
Most of the traffic looked like reconnaissance — attackers checking whether a target was even vulnerable. A smaller portion went all the way and tried to complete the full chain to create an admin account.
The speed of this activity is a good reminder that security patches need to go in the moment they’re available, not on some later maintenance window.
What Should Site Owners Do Right Now?
1. Patch WordPress core. Head to Dashboard > Updates in your WordPress admin panel and install whatever version is current for your branch — confirm you land on 7.0.2, 6.9.5, 6.8.6, or newer. If you don’t already run automatic backups, back up your files and database before updating.
2. Audit your administrator accounts. Open Users > All Users and go through every account holding the Administrator role. Disable or delete anything you don’t recognize — and don’t assume an unfamiliar account is fine just because it looks harmless. Verify who owns it first.
3. Go through your installed plugins. Look for anything on the Plugins page that you didn’t personally install. A compromised admin account is often used to upload a plugin that’s really just a disguised web shell. If you find something suspicious, preserve a backup or evidence of it before deleting, in case you need to investigate further.
4. Scan your files for changes. Watch for PHP files that were recently created or modified, especially in folders that shouldn’t contain PHP at all. Focus especially on:
/wp-content/uploads//wp-content/plugins//wp-content/themes/- The WordPress root directory
A stray PHP file sitting in your uploads folder is a major red flag.
5. Dig through your logs. Search for activity involving:
/wp-json/batch/v1rest_route=/batch/v1- Odd POST requests hitting
/ - The
author_excludeparameter - Nested
requestsarrays in request bodies - Unexpected hits on
/wp/v2/users
Keep in mind the batch route can show up inside the POST body instead of the URL itself, so a log search that only checks the path might miss it entirely.
6. Rotate credentials if you find signs of compromise. If there’s evidence your site was breached, reset:
- WordPress admin passwords
- Hosting account login
- SFTP/SSH credentials
- Database passwords
- Control panel login
- API keys and application passwords
It’s also worth regenerating the security salts in wp-config.php — that kills any active login sessions instantly.
Patching the vulnerability closes the door going forward, but it won’t clean up anything an attacker already left behind — rogue admin accounts, planted plugins, web shells, or other backdoors need to be removed separately.
How Prime Technologies Customers Can Stay Safer
Keeping WordPress up to date is still the single most important thing you can do. On top of that, hosting with a security-focused provider like Prime Technologies adds extra layers: ongoing server monitoring, malware scanning, firewall protection, account isolation, regular backups, and easier recovery tools if something does go wrong.
Prime Technologies customers can also add Prime V-Shield, a paid security add-on built on Patchstack’s technology. It scans WordPress core, plugins, and themes for known vulnerabilities and helps guard against emerging threats at the application level. It’s available as an Addon Booster through the Prime Technologies Client Area.
Beyond that, make sure automatic core updates are switched on and take another look at your admin account list. And if you spot anything odd — strange files, unknown users, unexpected redirects — reach out to support right away.
Quick Answers
What’s the WordPress vulnerability everyone’s talking about? It’s a combination of CVE-2026-60137 and CVE-2026-63030 that together let an attacker without any credentials run a SQL injection attack and potentially take over a WordPress site.
Which version fixes it? 7.0.2, 6.9.5, and 6.8.6, along with any later secure release.
Is it being actively exploited? Yes — Patchstack recorded exploitation attempts starting almost immediately after the patch shipped.
Is updating enough to undo an attack? No. It stops the vulnerability from being exploited further, but any admin accounts, plugins, or backdoors an attacker already installed will still be there until you remove them manually.
