Recent reports indicate that cybercriminals are actively exploiting two critical vulnerabilities in WordPress, potentially compromising millions of websites. These flaws, identified as CVE-2026-63030 and CVE-2026-60137, were patched by WordPress on July 17, 2026. However, many sites remain unpatched, leaving them susceptible to attacks.
The vulnerabilities, collectively known as ‘wp2shell,’ allow unauthenticated attackers to execute arbitrary code on default WordPress installations without the need for plugins or user interaction. This exploit chain combines a REST API batch-route confusion with a SQL injection in WP_Query, enabling full remote code execution. The affected versions include WordPress 6.9.0 through 6.9.4 and 7.0.0 to 7.0.1. To address these issues, WordPress released versions 6.9.5 and 7.0.2, implementing forced automatic updates where possible. However, administrators are advised to verify that their sites have been updated, as auto-updates can fail on some configurations.
Despite these efforts, cybersecurity firms such as Patchstack, Hexastrike, and WatchTowr have observed active exploitation of these vulnerabilities in the wild. The exact number of affected websites is uncertain, but estimates suggest that tens of millions could be at risk. For instance, cybersecurity consultant Daniel Card analyzed a sample of approximately 4,200 WordPress sites and found that less than 15% were vulnerable. Extrapolating this data suggests that around 90 million sites could be affected globally.
In response to these threats, Cloudflare has deployed new Web Application Firewall (WAF) protections to mitigate attacks targeting these vulnerabilities. While these measures provide an additional layer of defense, they are not a substitute for applying the official patches. Website administrators are urged to update their WordPress installations immediately to versions 6.9.5 or 7.0.2 and to confirm that the updates have been successfully applied.
These incidents underscore the critical importance of timely software updates and proactive security measures. As WordPress powers a significant portion of the internet, vulnerabilities in its core can have widespread implications. Administrators should prioritize patching, implement robust security practices, and consider additional protections such as WAFs to safeguard their sites against emerging threats.
