WordPress Core RCE flaws exploited to plant webshells

A pair of critical flaws in WordPress Core, the software behind roughly 40% of all websites, is being actively exploited to plant hidden webshells and seize control of servers, security researchers warn. The bugs, tracked as CVE-2026-63030 and CVE-2026-60137, let an unauthenticated attacker abuse the REST API's batch-processing feature to run code, and attackers began probing for them within hours of disclosure. WordPress has shipped automatic patches in versions 7.0.2, 6.9.5 and 6.8.6. If your site is not on one of those, treat it as urgent.

• The bugs: an authentication bypass chained with a remote code execution flaw in WordPress Core's REST API batch endpoint, not a third-party plugin.
• Live exploitation: researchers at SearchLight Cyber logged the first probing on July 17 at 23:29 UTC, with SQL-injection attempts 13 minutes later, then mass scanning.
• The payload: attackers drop obfuscated webshells disguised as legitimate plugins and register rogue REST endpoints for remote commands.
• The fix: update to 7.0.2, 6.9.5 or 6.8.6 now; a tracked sample of 124,580 sites showed 81.6% patched, leaving tens of thousands still exposed.

What are CVE-2026-63030 and CVE-2026-60137?

The two vulnerabilities work as a chain against WordPress Core itself, not a plugin or theme. CVE-2026-60137 is an authentication bypass that lets an attacker reach functionality they should not be able to touch. CVE-2026-63030 is a remote code execution flaw in the REST API's batch-processing feature, which lets a single crafted request bundle multiple operations. Chained together, an unauthenticated attacker on the open internet can send one request to the batch endpoint and end up running arbitrary code on the server. Because the flaw is in Core, it affects the base install regardless of which plugins or theme a site runs, which is what makes it so widely dangerous.

RelatedA PraisonAI Flaw Was Exploited Within Hours of Disclosure

How fast did attackers move?

Very fast. Researchers at SearchLight Cyber, who disclosed the issue, recorded the first probing attempts on July 17 at 23:29 UTC. SQL-injection attempts followed just 13 minutes later, and mass scanning was confirmed within days. That compressed timeline is now the norm: automated scanners weaponize a disclosed WordPress Core flaw within hours, because the payoff, control of a huge population of near-identical sites, is enormous. The window between "patch released" and "internet-wide exploitation" is often shorter than a single working day, which is why waiting for a maintenance window is the wrong instinct here.

1. Jul 17, 23:29 UTCFirst probing of the batch endpoint SearchLight Cyber telemetry
2. +13 minSQL-injection attempts begin automated tooling
3. Within daysMass scanning and exploitation confirmed internet-wide
4. Ongoing124,580-site sample reaches 81.6% patched tens of thousands still exposed

What do the webshells do?

Once code execution lands, the attackers establish persistence rather than smash and grab. SearchLight observed feature-rich, obfuscated webshells dropped into the site and disguised as legitimate plugins, which helps them survive a casual look at the plugin list. Some payloads register malicious REST API endpoints of their own, giving the attacker a clean remote-command channel that blends into normal WordPress traffic. From there a compromised site can be used for spam, redirects, credential theft, or as a staging point for further attacks. A hidden webshell is the digital equivalent of a copied house key: the front door looks locked, but someone else can walk in whenever they like.

Who is exposed and what should you do?

Any WordPress site running a version older than 7.0.2, 6.9.5 or 6.8.6 is at risk. Most modern installs receive automatic minor updates, and WordPress pushed these patches to supported installations automatically, which is why the tracked patch rate climbed past 80% quickly. But the remaining share is not trivial: in a 124,580-site sample, nearly one in five was still unpatched, and across the tens of millions of WordPress sites worldwide that is an enormous exposed surface. Confirm your core version now, and if it lags, update immediately. Because active exploitation predates many sites' patching, also check for unfamiliar plugins and unexpected REST endpoints, and treat any site that was unpatched during the exploitation window as potentially compromised, not merely at risk.

RelatedServiceNow's CVSS 9.5 Sandbox Escape Is Now Exploited

Our take

This is the WordPress threat model in one incident: a Core flaw plus a monoculture equals internet-scale exploitation before most admins have read the advisory. The genuinely good news is that automatic updates worked, carrying a large share of sites to safety within days, which is exactly what that much-debated feature exists to do. The bad news is that the minority which disable auto-updates or run unmaintained sites are precisely the ones attackers count on, and 13 minutes from probe to SQL injection shows how little grace period they get. If you run WordPress, the correct posture toward Core security releases is not "schedule it" but "apply it now," and this incident is the reason why.

Original analysis by GenZTech. Source: BleepingComputer.