{"id":514,"date":"2026-07-25T08:05:04","date_gmt":"2026-07-25T08:05:04","guid":{"rendered":"https:\/\/primetechnologies.co.za\/blog\/?p=514"},"modified":"2026-07-25T22:00:13","modified_gmt":"2026-07-25T22:00:13","slug":"critical-wordpress-core-flaw-under-active-attack-update-now","status":"publish","type":"post","link":"https:\/\/primetechnologies.co.za\/blog\/critical-wordpress-core-flaw-under-active-attack-update-now\/","title":{"rendered":"Critical WordPress Core Flaw Under Active Attack \u2014 Update Now"},"content":{"rendered":"\n<div class=\"wp-block-uagb-image uagb-block-434e119e wp-block-uagb-image--layout-default wp-block-uagb-image--effect-static wp-block-uagb-image--align-none\"><figure class=\"wp-block-uagb-image__figure\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-1024x512.png\" alt=\"\" class=\"uag-image-601\" width=\"1024\" height=\"564\" title=\"core\" loading=\"lazy\" role=\"img\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Critical WordPress Core Flaw Under Active Attack \u2014 Update Now<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color has-medium-font-size wp-elements-8e857f47c8aa09ceca35926945c84b66 wp-block-paragraph\">A newly disclosed WordPress core security flaw is letting attackers seize control of vulnerable sites without needing any login credentials at all. Anyone running an affected version should patch immediately and check their site for signs of tampering.<\/p>\n\n\n\n<p class=\"has-black-color has-text-color has-link-color wp-elements-ccc3d59299401b167daab93a5dd7f5c4 wp-block-paragraph\">The danger comes from two separate bugs that, when used together, let an outsider slip past input checks, run a SQL injection attack, plant a fake admin account, and push malicious code onto the server.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-7a9f03a0a8567ca84087ece24f99e9c5 wp-block-paragraph\">WordPress shipped fixes for the impacted branches on July 17, 2026, and real-world attacks began almost immediately, so anyone still on an older build needs to act fast \u2014 both to patch and to look for evidence their site was already hit.<\/p>\n\n\n\n<h2 class=\"wp-block-heading has-large-font-size\">Table of Contents<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>What&#8217;s Actually Wrong With WordPress Core?<\/li>\n\n\n\n<li>Which Versions Are Exposed?<\/li>\n\n\n\n<li>Are Attackers Already Exploiting This?<\/li>\n\n\n\n<li>What Should Site Owners Do Right Now?<\/li>\n\n\n\n<li>How Prime Technologies Customers Can Stay Safer<\/li>\n\n\n\n<li>Quick Answers<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">What&#8217;s Actually Wrong With WordPress Core?<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-53c1e19e7da1087bab7e4fbb329b60aa wp-block-paragraph\">Two distinct flaws in WordPress core form the attack chain:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-336e50e54c5ebc6bd109b30e65c1ee6d\"><strong>CVE-2026-60137<\/strong> \u2014 a<a href=\"https:\/\/www.cloudflare.com\/learning\/security\/threats\/sql-injection\/\"> SQL injection<\/a> bug tied to <code>WP_Query<\/code>.<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-f663ac18b8b65c95f5de5301f9f9e4de\"><strong>CVE-2026-63030<\/strong> \u2014 a routing mix-up in the WordPress REST API&#8217;s batch endpoint that confuses which handler processes a request.<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-df037dcf5d90ea99f3ec60b0cad1fe17 wp-block-paragraph\">Chained together, these let someone with zero credentials sidestep normal safeguards and reach database operations they should never be able to touch.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-0aec49b9a04daad94bd3cfc718ed7942 wp-block-paragraph\">From there, the attacker can typically spin up a rogue administrator account and execute code remotely \u2014 effectively handing them the keys to the site. That access can be used to drop in malicious plugins, tamper with files, redirect site visitors elsewhere, or quietly plant a backdoor for later.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Which Versions Are Exposed?<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-af1ff6dc7eb04192903a77eef994167b\">The SQL injection issue hits WordPress <strong>6.8 through 7.0.1<\/strong>.<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-fd90306b920180e5eed591892f3c31fe\">The REST API routing issue hits WordPress <strong>6.9 through 7.0.1<\/strong>.<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-af25ae34ab1db887c1229bd19ba941c5 wp-block-paragraph\">Patches landed in:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress <strong>7.0.2<\/strong><\/li>\n\n\n\n<li>WordPress <strong>6.9.5<\/strong><\/li>\n\n\n\n<li>WordPress <strong>6.8.6<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-55e260562ddd13a4b7d2184d69ffb1b7 wp-block-paragraph\">Older, unsupported versions may dodge these two specific CVEs, but they&#8217;re almost certainly carrying other unpatched holes. Staying on a current, fully updated release is still the safest bet.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Are Attackers Already Exploiting This?<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-2956f1ae1431c22153becffb81a1e57e wp-block-paragraph\">Yes \u2014 and quickly. Security firm Patchstack observed the earliest exploitation attempts roughly an hour and a half after version 7.0.2 went live.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-24fee5a7ce66bd7d6e20ee2384d64789 wp-block-paragraph\">In the days that followed, <a href=\"https:\/\/patchstack.com\/articles\/ninety-minutes-watching-attackers-weaponize-the-wordpress-core-rce\/\">Patchstack&#8217;s systems<\/a> blocked more than 65,000 attack attempts coming from over 1,500 distinct IP addresses, all aimed at sites still running the vulnerable code.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-01111a10e19ddba7f63657dc16f7718d wp-block-paragraph\">Roughly 97% of those blocked requests went after the REST API batch endpoint specifically, with attackers rotating through different URL formats and disguising their SQL injection payloads to dodge basic filters.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-29e39ac62bf9f087ea6de09252de1029 wp-block-paragraph\">Most of the traffic looked like reconnaissance \u2014 attackers checking whether a target was even vulnerable. A smaller portion went all the way and tried to complete the full chain to create an admin account.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-b20b1793f9ff10d2620268ed144f9fd5 wp-block-paragraph\">The speed of this activity is a good reminder that security patches need to go in the moment they&#8217;re available, not on some later maintenance window.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What Should Site Owners Do Right Now?<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-2727d0780b1a3fa16f6cf4316d7c2cb1 wp-block-paragraph\"><strong>1. Patch WordPress core.<\/strong> Head to Dashboard &gt; Updates in your WordPress admin panel and install whatever version is current for your branch \u2014 confirm you land on 7.0.2, 6.9.5, 6.8.6, or newer. If you don&#8217;t already run automatic backups, back up your files and database before updating.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-57cffa3bdbe306cdc323892702e60047 wp-block-paragraph\"><strong>2. Audit your administrator accounts.<\/strong> Open Users &gt; All Users and go through every account holding the Administrator role. Disable or delete anything you don&#8217;t recognize \u2014 and don&#8217;t assume an unfamiliar account is fine just because it looks harmless. Verify who owns it first.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-956fbd5b7bd18c73588d25f839c39dc2 wp-block-paragraph\"><strong>3. Go through your installed plugins.<\/strong> Look for anything on the Plugins page that you didn&#8217;t personally install. A compromised admin account is often used to upload a plugin that&#8217;s really just a disguised web shell. If you find something suspicious, preserve a backup or evidence of it before deleting, in case you need to investigate further.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-895f5ae615b74eb2311928b72170af04 wp-block-paragraph\"><strong>4. Scan your files for changes.<\/strong> Watch for PHP files that were recently created or modified, especially in folders that shouldn&#8217;t contain PHP at all. Focus especially on:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-c6289b176f03767f3e0cf01d768c0e2c\"><code>\/wp-content\/uploads\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-045cb97a6e0d42702ec3f155160a0b38\"><code>\/wp-content\/plugins\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-a376cbec1d7cccdf809d84853a33f669\"><code>\/wp-content\/themes\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-767fa1f032c087caf3829df351cb146b\">The WordPress root directory<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-0602b1cf904170c750e2ba60a7e87746 wp-block-paragraph\">A stray PHP file sitting in your uploads folder is a major red flag.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-c5175644ec902623be743c2c6d011c3b wp-block-paragraph\"><strong>5. Dig through your logs.<\/strong> Search for activity involving:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-71d955e83644338be4d29cbe7f58b3fa\"><code>\/wp-json\/batch\/v1<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-051047e5ff5ce7c26c7c9e817446d49f\"><code>rest_route=\/batch\/v1<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-7ae83b7faccb46b61afecd57741436b2\">Odd POST requests hitting <code>\/<\/code><\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-69b12eddde79ad9198a359e01364ee11\">The <code>author_exclude<\/code> parameter<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-a3e4f0a08077053d0fa9968296fcad9e\">Nested <code>requests<\/code> arrays in request bodies<\/li>\n\n\n\n<li class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-a57e1902862cb6476283913199d9dcc9\">Unexpected hits on <code>\/wp\/v2\/users<\/code><\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-0f4918ef4104f54f8098487d886cbce8 wp-block-paragraph\">Keep in mind the batch route can show up inside the POST body instead of the URL itself, so a log search that only checks the path might miss it entirely.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-c46fdaf9ed376a4b4e1c2396dccb5605 wp-block-paragraph\"><strong>6. Rotate credentials if you find signs of compromise.<\/strong> If there&#8217;s evidence your site was breached, reset:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress admin passwords<\/li>\n\n\n\n<li>Hosting account login<\/li>\n\n\n\n<li>SFTP\/SSH credentials<\/li>\n\n\n\n<li>Database passwords<\/li>\n\n\n\n<li>Control panel login<\/li>\n\n\n\n<li>API keys and application passwords<\/li>\n<\/ul>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-add839984380cf1a525e5657a1fea95d wp-block-paragraph\">It&#8217;s also worth regenerating the security salts in <code>wp-config.php<\/code> \u2014 that kills any active login sessions instantly.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-d3c88ecc10d51e9f49465ad7b48c9561 wp-block-paragraph\">Patching the vulnerability closes the door going forward, but it won&#8217;t clean up anything an attacker already left behind \u2014 rogue admin accounts, planted plugins, web shells, or other backdoors need to be removed separately.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How Prime Technologies Customers Can Stay Safer<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-b172b87d0329e25d41373eab7dc20ffd wp-block-paragraph\">Keeping WordPress up to date is still the single most important thing you can do. On top of that, hosting with a security-focused provider like <a href=\"https:\/\/primetechnologies.co.za\/\">Prime Technologies<\/a> adds extra layers: ongoing server monitoring, malware scanning, firewall protection, account isolation, regular backups, and easier recovery tools if something does go wrong.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-d762d09b89d5e8a813124df7313dea97 wp-block-paragraph\">Prime Technologies customers can also add <strong>Prime V-Shield<\/strong>, a paid security add-on built on Patchstack&#8217;s technology. It scans WordPress core, plugins, and themes for known vulnerabilities and helps guard against emerging threats at the application level. It&#8217;s available as an Addon Booster through the Prime Technologies Client Area.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-13df2452df47313ea662d0cd1a8c2560 wp-block-paragraph\">Beyond that, make sure automatic core updates are switched on and take another look at your admin account list. And if you spot anything odd \u2014 strange files, unknown users, unexpected redirects \u2014 reach out to support right away.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Quick Answers<\/h2>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-36029782b615919f856c9df79545c77a wp-block-paragraph\"><strong>What&#8217;s the WordPress vulnerability everyone&#8217;s talking about?<\/strong> It&#8217;s a combination of CVE-2026-60137 and CVE-2026-63030 that together let an attacker without any credentials run a <a href=\"https:\/\/www.cloudflare.com\/learning\/security\/threats\/sql-injection\/\">SQL injection<\/a> attack and potentially take over a WordPress site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Which version fixes it?<\/strong> 7.0.2, 6.9.5, and 6.8.6, along with any later secure release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"font-size:14px\"><strong>Is it being actively exploited?<\/strong> Yes \u2014 <a href=\"https:\/\/patchstack.com\/articles\/ninety-minutes-watching-attackers-weaponize-the-wordpress-core-rce\/\">Patchstack recorded<\/a> exploitation attempts starting almost immediately after the patch shipped.<\/p>\n\n\n\n<p class=\"has-ast-global-color-8-color has-text-color has-link-color wp-elements-d7b6280491ff6436b09d74cb2356d51f wp-block-paragraph\"><strong>Is updating enough to undo an attack?<\/strong> No. It stops the vulnerability from being exploited further, but any admin accounts, plugins, or backdoors an attacker already installed will still be there until you remove them manually.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Critical WordPress Core Flaw Under Active Attack \u2014 Update Now A newly disclosed WordPress core security flaw is letting attackers [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":601,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_eb_attr":"","_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-514","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress"],"uagb_featured_image_src":{"full":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1.png",1774,887,false],"thumbnail":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-150x150.png",150,150,true],"medium":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-300x150.png",300,150,true],"medium_large":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-768x384.png",768,384,true],"large":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-1024x512.png",1024,512,true],"1536x1536":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1-1536x768.png",1536,768,true],"2048x2048":["https:\/\/primetechnologies.co.za\/blog\/wp-content\/uploads\/2026\/07\/core-1.png",1774,887,false]},"uagb_author_info":{"display_name":"primetech940","author_link":"https:\/\/primetechnologies.co.za\/blog\/author\/primetech940\/"},"uagb_comment_info":0,"uagb_excerpt":"Critical WordPress Core Flaw Under Active Attack \u2014 Update Now A newly disclosed WordPress core security flaw is letting attackers [&hellip;]","_links":{"self":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts\/514","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/comments?post=514"}],"version-history":[{"count":5,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts\/514\/revisions"}],"predecessor-version":[{"id":627,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/posts\/514\/revisions\/627"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/media\/601"}],"wp:attachment":[{"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/media?parent=514"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/categories?post=514"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/primetechnologies.co.za\/blog\/wp-json\/wp\/v2\/tags?post=514"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}