WordPress Security Alert! Protect Your Website

by Website Security

Two critical WordPress vulnerabilities have been exploited in the wild, putting unpatched websites at risk of remote code execution.

WordPress released version 7.0.2 in July 2026 to address the flaws, identified as CVE-2026-60137 and CVE-2026-63030. Website owners should verify that their installations are protected and apply the appropriate security updates promptly.

For organizations that depend on WordPress, staying current with security changes is essential. UserX helps organizations manage WordPress maintenance and security so technical risks can be addressed before they disrupt business operations.

Understanding the 2026 WordPress Security Vulnerabilities

The two vulnerabilities, known collectively as wp2shell, can be chained together to achieve remote code execution (RCE). This can allow attackers to run malicious code on a website’s server without first authenticating.

  • CVE-2026-63030: A REST API batch-route confusion vulnerability that can be combined with the second flaw to enable remote code execution.
  • CVE-2026-60137: An SQL injection vulnerability involving the author__not_in parameter in WordPress’s WP_Query functionality.

Successful exploitation can expose password hashes, enable unauthorized access, and allow attackers to install malicious plugins or execute commands. Compromised websites may then be used to distribute malware, host phishing pages, or support further attacks.

Mitigation Strategies: Protecting Your WordPress Site

WordPress 7.0.2 addressed these vulnerabilities, with corresponding security releases for older branches. However, newer releases are now available. Update to the latest appropriate WordPress version offered for your installation, rather than relying on the original fix alone.

Practical steps include:

  • Back up your site before making changes, and confirm that the backup can be restored.
  • Update WordPress core promptly through your administration dashboard under Dashboard → Updates.
  • Update plugins and themes to reduce exposure to other known vulnerabilities.
  • Use a Web Application Firewall (WAF) to help block malicious requests and known attack patterns.
  • Review file permissions and server access to limit unnecessary access.

UserX provides WordPress maintenance, security, and technical support to help organizations identify risks, address vulnerabilities, and keep their websites reliable. Contact UserX if you need help checking your site’s security or keeping it up to date.

Verifying Your Site’s Security

After updating, confirm that the update completed successfully and that no additional security updates remain pending.

Because these vulnerabilities have been exploited, updating alone may not be sufficient if a site was previously exposed. Review unexpected file changes, unfamiliar administrator accounts, suspicious activity, or other signs of compromise. If you suspect an intrusion, arrange a professional security review.

Regular updates, reliable backups, and ongoing monitoring help reduce the risk from future vulnerabilities. If you’re unsure whether your website is protected, your website administrator or a WordPress support specialist can help verify its status.

Source and Further Reading