WordPress flaws exploited after public disclosure, researchers warn of widespread compromise

Attackers began targeting two newly patched WordPress vulnerabilities within hours of their disclosure, according to security researchers. When chained, the flaws can enable unauthenticated remote code execution on vulnerable installations, including default sites without third-party plugins.

WordPress issued fixes late Friday, but exploitation reportedly accelerated soon afterward. Researchers observed attacks initially aimed at extracting hashed credentials, followed by attempts to gain code execution once more technical details and proof-of-concept material became available.

How the vulnerabilities work

CVE-2026-60137 is a moderate-severity SQL injection vulnerability. CVE-2026-63030, dubbed “wp2shell” by its discoverer, is a critical flaw involving confusion in the REST API’s batch-route processing. A validation problem can cause WordPress to mismatch submitted requests, validation results and request handlers, allowing requests that should have been rejected to be treated as trusted.

Individually, the vulnerabilities are harder to exploit. Used together, however, they can provide a path from an unauthenticated request to remote code execution, creating opportunities to steal credentials, install malware or take control of a site.

Exploitation activity

Researchers from watchTowr said they recorded tens of thousands of attempts against honeypots and identified more than 100 backdoor administrator accounts created with different versions of publicly available tools. Attackers also installed malicious plugins to maintain access, execute commands, steal secrets and retrieve additional payloads. In one observed case, an actor attempted to download Overlord RAT, a Golang-based remote-access trojan.

VulnCheck reported finding more than two dozen distinct proof-of-concept exploits, while PatchStack also reported active exploitation. Researchers said the availability of public code and AI-assisted vulnerability reproduction lowered the barrier to developing attacks.

Versions and response

WordPress 6.9 is affected, with version 6.9.5 addressing both flaws. WordPress 6.8 requires version 6.8.6 to fix the SQL injection issue. WordPress 7.1 Beta 2 resolves the problems present in Beta 1; releases earlier than 6.8 are not affected.

WordPress has enabled forced updates for affected sites. Administrators should update immediately and investigate for unfamiliar administrator accounts, unauthorized plugins, suspicious files and other signs of compromise—even if updates have already been installed.