{"id":514,"date":"2026-07-25T08:05:04","date_gmt":"2026-07-25T08:05:04","guid":{"rendered":"https:\/\/primetechnologies.co.za\/blog\/?p=514"},"modified":"2026-07-25T22:00:13","modified_gmt":"2026-07-25T22:00:13","slug":"critical-wordpress-core-flaw-under-active-attack-update-now","status":"publish","type":"post","link":"https:\/\/primetechnologies.co.za\/blog\/critical-wordpress-core-flaw-under-active-attack-update-now\/","title":{"rendered":"Critical WordPress Core Flaw Under Active Attack \u2014 Update Now"},"content":{"rendered":"\n<div class=\"wp-block-uagb-image uagb-block-434e119e wp-block-uagb-image--layout-default wp-block-uagb-image--effect-static wp-block-uagb-image--align-none\"><figure class=\"wp-block-uagb-image__figure\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-1024x512.png\" alt=\"\" class=\"uag-image-601\" width=\"1024\" height=\"564\" title=\"core\" loading=\"lazy\" role=\"img\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Critical WordPress Core Flaw Under Active Attack \u2014 Update Now<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color has-medium-font-size wp-elements-1 wp-block-paragraph\">A newly disclosed WordPress core security flaw is letting attackers seize control of vulnerable sites without needing any login credentials at all. Anyone running an affected version should patch immediately and check their site for signs of tampering.<\/p>\n\n\n\n<p class=\"has-black-color has-text-color has-link-color wp-elements-2 wp-block-paragraph\">The danger comes from two separate bugs that, when used together, let an outsider slip past input checks, run a SQL injection attack, plant a fake admin account, and push malicious code onto the server.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-3 wp-block-paragraph\">WordPress shipped fixes for the impacted branches on July 17, 2026, and real-world attacks began almost immediately, so anyone still on an older build needs to act fast \u2014 both to patch and to look for evidence their site was already hit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-large-font-size\">Table of Contents<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What&#8217;s Actually Wrong With WordPress Core?<\/li>\n\n\n\n<li>Which Versions Are Exposed?<\/li>\n\n\n\n<li>Are Attackers Already Exploiting This?<\/li>\n\n\n\n<li>What Should Site Owners Do Right Now?<\/li>\n\n\n\n<li>How Prime Technologies Customers Can Stay Safer<\/li>\n\n\n\n<li>Quick Answers<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What&#8217;s Actually Wrong With WordPress Core?<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-4 wp-block-paragraph\">Two distinct flaws in WordPress core form the attack chain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-5\"><strong>CVE-2026-60137<\/strong> \u2014 a<a href=\"https:\/\/www.cloudflare.com\/learning\/security\/threats\/sql-injection\/\"> SQL injection<\/a> bug tied to <code>WP_Query<\/code>.<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-6\"><strong>CVE-2026-63030<\/strong> \u2014 a routing mix-up in the WordPress REST API&#8217;s batch endpoint that confuses which handler processes a request.<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-7 wp-block-paragraph\">Chained together, these let someone with zero credentials sidestep normal safeguards and reach database operations they should never be able to touch.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-8 wp-block-paragraph\">From there, the attacker can typically spin up a rogue administrator account and execute code remotely \u2014 effectively handing them the keys to the site. That access can be used to drop in malicious plugins, tamper with files, redirect site visitors elsewhere, or quietly plant a backdoor for later.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which Versions Are Exposed?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-9\">The SQL injection issue hits WordPress <strong>6.8 through 7.0.1<\/strong>.<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-10\">The REST API routing issue hits WordPress <strong>6.9 through 7.0.1<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-11 wp-block-paragraph\">Patches landed in:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress <strong>7.0.2<\/strong><\/li>\n\n\n\n<li>WordPress <strong>6.9.5<\/strong><\/li>\n\n\n\n<li>WordPress <strong>6.8.6<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-12 wp-block-paragraph\">Older, unsupported versions may dodge these two specific CVEs, but they&#8217;re almost certainly carrying other unpatched holes. Staying on a current, fully updated release is still the safest bet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Are Attackers Already Exploiting This?<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-13 wp-block-paragraph\">Yes \u2014 and quickly. Security firm Patchstack observed the earliest exploitation attempts roughly an hour and a half after version 7.0.2 went live.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-14 wp-block-paragraph\">In the days that followed, <a href=\"https:\/\/patchstack.com\/articles\/ninety-minutes-watching-attackers-weaponize-the-wordpress-core-rce\/\">Patchstack&#8217;s systems<\/a> blocked more than 65,000 attack attempts coming from over 1,500 distinct IP addresses, all aimed at sites still running the vulnerable code.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-15 wp-block-paragraph\">Roughly 97% of those blocked requests went after the REST API batch endpoint specifically, with attackers rotating through different URL formats and disguising their SQL injection payloads to dodge basic filters.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-16 wp-block-paragraph\">Most of the traffic looked like reconnaissance \u2014 attackers checking whether a target was even vulnerable. A smaller portion went all the way and tried to complete the full chain to create an admin account.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-17 wp-block-paragraph\">The speed of this activity is a good reminder that security patches need to go in the moment they&#8217;re available, not on some later maintenance window.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Should Site Owners Do Right Now?<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-18 wp-block-paragraph\"><strong>1. Patch WordPress core.<\/strong> Head to Dashboard &gt; Updates in your WordPress admin panel and install whatever version is current for your branch \u2014 confirm you land on 7.0.2, 6.9.5, 6.8.6, or newer. If you don&#8217;t already run automatic backups, back up your files and database before updating.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-19 wp-block-paragraph\"><strong>2. Audit your administrator accounts.<\/strong> Open Users &gt; All Users and go through every account holding the Administrator role. Disable or delete anything you don&#8217;t recognize \u2014 and don&#8217;t assume an unfamiliar account is fine just because it looks harmless. Verify who owns it first.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-20 wp-block-paragraph\"><strong>3. Go through your installed plugins.<\/strong> Look for anything on the Plugins page that you didn&#8217;t personally install. A compromised admin account is often used to upload a plugin that&#8217;s really just a disguised web shell. If you find something suspicious, preserve a backup or evidence of it before deleting, in case you need to investigate further.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-21 wp-block-paragraph\"><strong>4. Scan your files for changes.<\/strong> Watch for PHP files that were recently created or modified, especially in folders that shouldn&#8217;t contain PHP at all. Focus especially on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-22\"><code>\/wp-content\/uploads\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-23\"><code>\/wp-content\/plugins\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-24\"><code>\/wp-content\/themes\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-25\">The WordPress root directory<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-26 wp-block-paragraph\">A stray PHP file sitting in your uploads folder is a major red flag.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-27 wp-block-paragraph\"><strong>5. Dig through your logs.<\/strong> Search for activity involving:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-28\"><code>\/wp-json\/batch\/v1<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-29\"><code>rest_route=\/batch\/v1<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-30\">Odd POST requests hitting <code>\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-31\">The <code>author_exclude<\/code> parameter<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-32\">Nested <code>requests<\/code> arrays in request bodies<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-33\">Unexpected hits on <code>\/wp\/v2\/users<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-34 wp-block-paragraph\">Keep in mind the batch route can show up inside the POST body instead of the URL itself, so a log search that only checks the path might miss it entirely.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-35 wp-block-paragraph\"><strong>6. Rotate credentials if you find signs of compromise.<\/strong> If there&#8217;s evidence your site was breached, reset:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress admin passwords<\/li>\n\n\n\n<li>Hosting account login<\/li>\n\n\n\n<li>SFTP\/SSH credentials<\/li>\n\n\n\n<li>Database passwords<\/li>\n\n\n\n<li>Control panel login<\/li>\n\n\n\n<li>API keys and application passwords<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-36 wp-block-paragraph\">It&#8217;s also worth regenerating the security salts in <code>wp-config.php<\/code> \u2014 that kills any active login sessions instantly.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-37 wp-block-paragraph\">Patching the vulnerability closes the door going forward, but it won&#8217;t clean up anything an attacker already left behind \u2014 rogue admin accounts, planted plugins, web shells, or other backdoors need to be removed separately.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Prime Technologies Customers Can Stay Safer<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-38 wp-block-paragraph\">Keeping WordPress up to date is still the single most important thing you can do. On top of that, hosting with a security-focused provider like <a href=\"https:\/\/primetechnologies.co.za\/\">Prime Technologies<\/a> adds extra layers: ongoing server monitoring, malware scanning, firewall protection, account isolation, regular backups, and easier recovery tools if something does go wrong.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-39 wp-block-paragraph\">Prime Technologies customers can also add <strong>Prime V-Shield<\/strong>, a paid security add-on built on Patchstack&#8217;s technology. It scans WordPress core, plugins, and themes for known vulnerabilities and helps guard against emerging threats at the application level. It&#8217;s available as an Addon Booster through the Prime Technologies Client Area.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-40 wp-block-paragraph\">Beyond that, make sure automatic core updates are switched on and take another look at your admin account list. And if you spot anything odd \u2014 strange files, unknown users, unexpected redirects \u2014 reach out to support right away.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Quick Answers<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-41 wp-block-paragraph\"><strong>What&#8217;s the WordPress vulnerability everyone&#8217;s talking about?<\/strong> It&#8217;s a combination of CVE-2026-60137 and CVE-2026-63030 that together let an attacker without any credentials run a <a href=\"https:\/\/www.cloudflare.com\/learning\/security\/threats\/sql-injection\/\">SQL injection<\/a> attack and potentially take over a WordPress site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Which version fixes it?<\/strong> 7.0.2, 6.9.5, and 6.8.6, along with any later secure release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\"><strong>Is it being actively exploited?<\/strong> Yes \u2014 <a href=\"https:\/\/patchstack.com\/articles\/ninety-minutes-watching-attackers-weaponize-the-wordpress-core-rce\/\">Patchstack recorded<\/a> exploitation attempts starting almost immediately after the patch shipped.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-42 wp-block-paragraph\"><strong>Is updating enough to undo an attack?<\/strong> No. It stops the vulnerability from being exploited further, but any admin accounts, plugins, or backdoors an attacker already installed will still be there until you remove them manually.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Critical WordPress Core Flaw Under Active Attack \u2014 Update Now A newly disclosed WordPress core security flaw is letting attackers [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":601,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress"],"uagb_featured_image_src":{"full":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1.png",1774,887,false],"thumbnail":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-150x150.png",150,150,true],"medium":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-300x150.png",300,150,true],"medium_large":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-768x384.png",768,384,true],"large":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-1024x512.png",1024,512,true],"1536x1536":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-1536x768.png",1536,768,true],"2048x2048":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1.png",1774,887,false]},"uagb_author_info":{"display_name":"primetech940","author_link":"https:\/\/primetechnologies.co.za\/blog\/author\/primetech940\/"},"uagb_comment_info":0,"uagb_excerpt":"Critical WordPress Core Flaw Under Active Attack \u2014 Update Now A newly disclosed WordPress core security flaw is letting attackers [&hellip;]","_links":{"self":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts\/514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/comments?post=514"}],"version-history":[{"count":5,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts\/514\/revisions"}],"predecessor-version":[{"id":627,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts\/514\/revisions\/627"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/media\/601"}],"wp:attachment":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/media?parent=514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/categories?post=514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/tags?post=514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}