The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding active exploitation of critical vulnerabilities in WordPress Core, specifically CVE-2026-63030 and CVE-2026-60137. These flaws, collectively referred to as “wp2shell,” can be combined to allow unauthenticated attackers to execute remote code on default WordPress installations.
WordPress, a widely used content management system, is integral to millions of websites globally. The identified vulnerabilities pose a significant risk, as they enable attackers to gain unauthorized access and control over affected sites without requiring authentication.
CVE-2026-63030 involves an interpretation conflict within the WordPress Core REST API’s batch processing, leading to potential SQL injection attacks. When exploited alongside CVE-2026-60137, which pertains to improper handling of untrusted input in database queries, attackers can escalate their access to execute arbitrary code remotely.
Security researchers have observed active exploitation of these vulnerabilities in the wild. Public proof-of-concept exploit code has been circulating, and incidents of credential exfiltration and deployment of web shells have been reported. This underscores the urgency for website administrators to address these issues promptly.
In response, CISA has added both CVE-2026-63030 and CVE-2026-60137 to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the critical nature of these flaws. Federal agencies are mandated to remediate CVE-2026-63030 by July 24, 2026, and CVE-2026-60137 by August 4, 2026, in accordance with Binding Operational Directive (BOD) 26-04.
WordPress has released patches to address these vulnerabilities. Administrators are strongly advised to update their installations to versions 7.0.2, 6.9.5, or 6.8.6, depending on their current version. Applying these updates is crucial to mitigate the risk of exploitation.
Beyond patching, organizations should implement additional security measures, such as monitoring for unusual administrative activity, reviewing web server logs for signs of compromise, and restricting access to critical systems. These steps can help detect and prevent potential attacks leveraging these vulnerabilities.
This incident highlights the importance of maintaining up-to-date software and promptly addressing security advisories. The widespread use of WordPress makes it a prime target for attackers, and vulnerabilities in its core can have far-reaching implications. Proactive security practices are essential to protect websites and the sensitive data they handle.
