• 2 min read
WordPress RCE exploit wave hit within hours of patch
Attackers began chaining two WordPress flaws within hours of Friday’s fixes, with researchers seeing tens of thousands of attempts by Sunday.
Image: The Register
If you run WordPress, the window to patch these bugs was measured in hours, not days. Security researchers say attackers quickly began chaining CVE-2026-60137 and CVE-2026-63030 to achieve pre-authentication remote code execution, and by Saturday morning exploitation was already widespread.
According to watchTowr principal security researcher Jake Knott, public disclosure dramatically lowered the barrier to attack.
“Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens.”
WordPress released fixes late Friday, but Knott told The Register that by the early hours of Saturday, attackers were already using public exploit code to steal hashed credentials, with RCE following once more details emerged. He said watchTowr was seeing impact across organizations “of every size and every vertical.”
The two flaws work differently:
- CVE-2026-60137 is a moderate-severity SQL injection bug
- CVE-2026-63030 is a critical REST API batch-route confusion flaw
Researchers at Hacktron said the route confusion issue misaligns arrays containing sub-requests, validation results, and matched handlers. In practice, that can cause WordPress to treat blocked requests as trusted. On their own, the bugs are harder to use, but chained together they allow unauthenticated RCE.
Recommended reading
Free 0Patch fix arrives for Windows LegacyHive zero-day
Affected versions are specific. WordPress 6.9 is vulnerable to both bugs, with fixes in 6.9.5. WordPress 6.8 is affected only by the SQL injection flaw, fixed in 6.8.6. WordPress 7.1 Beta 1 is also vulnerable, while 7.1 Beta 2 fixes both issues. Versions earlier than 6.8 are not affected.
Affected versions and exploitation activity
WordPress core developer John Blackbourn urged users to “update your sites immediately,” adding that the security team enabled forced updates via the auto-update system for affected versions.
The project credited Searchlight Cyber researcher Adam Kues with reporting CVE-2026-63030. In a Friday advisory, Kues called the bug wp2shell and said it can be exploited by an anonymous user on a stock WordPress install with no plugins. Searchlight Cyber also released a free wp2shell checker.
PatchStack said both CVEs were being exploited by Friday night. VulnCheck verified more than two dozen unique proof-of-concept exploits targeting WP2Shell as of Sunday.
Knott said watchTowr honeypots logged tens of thousands of exploitation attempts and more than 100 backdoor accounts created by different threat actors using variations of public tooling. After gaining access, attackers were seen planting fake WordPress plugins to get RCE, steal credentials or secrets, and fetch extra tools. In one case, Knott said, a threat actor repeatedly tried to download Overlord RAT, a Golang-based remote access trojan.
His warning was blunt: organizations that waited until Monday to patch are likely already compromised, and defenders should check for new administrator accounts, malicious plugins, and other suspicious files even after updating.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via The Register
