Critical WordPress Vulnerabilities Under Active Exploitation: What You Must Patch Now

The chained flaws can produce unauthenticated remote code execution on affected installations. For WordPress operators, this is not a routine patch-cycle item: public exploit code was followed by indiscriminate scanning of reachable sites.

The affected release paths

CVE-2026-63030 is a critical REST API batch-route confusion flaw, also called wp2shell by the researcher cited in the report. The defect can misalign sub-requests, validation results, and matched handlers. The result is a validation failure: requests that should be blocked may be treated as trusted.

CVE-2026-60137 is a moderate-severity SQL injection issue. Each vulnerability is described as difficult to exploit independently. Chained together, they permit pre-authentication RCE. No plugin, theme, or authenticated account is required on a stock vulnerable installation.

The version boundary is explicit:

1. WordPress 6.9 is affected by both CVEs. 6.9.5 fixes both.

2. WordPress 6.8 is affected by CVE-2026-60137. 6.8.6 fixes it.

3. WordPress 7.1 Beta 1 is vulnerable to both. 7.1 Beta 2 contains fixes.

The WordPress security team reportedly enabled forced updates for sites on affected releases. That reduces exposure, but it is not a verification result. Site owners still need to establish the running core version across every production, staging, and otherwise internet-reachable instance.

Exploitation moved from disclosure to scanning

The reported sequence is short: patches were released late Friday; exploitation was observed by early Saturday. Initial activity reportedly used public exploit code to exfiltrate hashed credentials, with RCE following as further details became public.

That distinction matters operationally. A successful automatic update closes the current vulnerable code path; it does not, by itself, establish whether the site was contacted or altered before the patch arrived. The report describes widespread impact across organizations and more than two dozen unique proof-of-concept exploits targeting wp2shell. Exposure should therefore be assessed by reachability and version, not by assumptions about site size or plugin inventory.

A sudden analytics anomaly is not conclusive evidence of compromise. It still deserves separation from ordinary acquisition and reporting failures; compare it with a case of EU traffic dropping overnight before assigning a security cause.

Minimum verification sequence

1. Record the active WordPress core version for each site and confirm it is at least 6.9.5 or 6.8.6, as applicable. Move 7.1 Beta 1 environments to Beta 2 if they remain online.

2. Treat any instance that was publicly reachable while running an affected release as an exposure candidate, including a plain WordPress install without plugins.

3. Review the period after public disclosure for signs described in reporting: hashed-credential exfiltration attempts and subsequent remote-code-execution activity.

4. Separate patch confirmation from incident confirmation. “Updated” is a state change, not a clean bill of health.

5. Keep beta installations out of the production security baseline unless their update and exposure status are tracked with the same discipline as production.

Expected baseline: no reachable instance on WordPress 6.9 below 6.9.5; no reachable 6.8 instance below 6.8.6; no remaining 7.1 Beta 1 deployment; and a documented review of the exposure window.