Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
This is a WordPress core vulnerability—not a third-party plugin flaw. WordPress fixed a critical security issue involving REST API batch-route confusion and SQL injection, with potential for remote code execution, in WordPress 7.0.2 on July 17, 2026. Administrators should verify their version immediately and update to 7.0.2, 6.9.5, or 6.8.6, depending on their release branch.
What happened?
WordPress 7.0.2 addressed one critical and one high-severity security issue. The official release identifies the affected component as WordPress core, so a site can be exposed even when it has no vulnerable plugin installed.
The issues are associated with CVE-2026-60137 (GHSA-fpp7-x2x2-2mjf) and CVE-2026-63030 (GHSA-ff9f-jf42-662q). WordPress describes one as a facilitated SQL-injection issue. The more serious chain combines REST API batch-route confusion with SQL injection and can lead to remote code execution.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsThat does not mean every vulnerable request automatically gives an attacker complete control of every website. Exploitability and impact depend on the site’s configuration and the attacker’s ability to reach and use the vulnerable code. However, a potential path to code execution in internet-facing WordPress core warrants immediate patching.
#1 Best Overall
Which WordPress versions are affected?
| Installed branch | Exposure | Fixed version |
|---|---|---|
| 7.0.0 or 7.0.1 | Both reported issues | 7.0.2 |
| 6.9.x before 6.9.5 | Both reported issues | 6.9.5 |
| 6.8.x before 6.8.6 | One reported issue | 6.8.6 |
| Before 6.8 | WordPress says these two issues do not affect these versions | Upgrade to a supported release |
WordPress says it enabled forced updates through its automatic-update system for affected installations. Do not rely on that alone: confirm the installed version yourself. “Unaffected by these two CVEs” also does not mean that an old, unsupported WordPress version is secure.
How to update WordPress
Using the administrator dashboard
- Log in to WordPress.
- Open Dashboard → Updates.
- Check the installed WordPress version.
- Select Update Now if the site is below its fixed branch release.
- Return to the Updates screen and confirm the fixed version.
- Test the public site, login, forms, checkout, REST API-dependent features, and important integrations.
WordPress provides release information and manual download guidance in its 7.0.2 documentation.
Using WP-CLI
wp core version
wp core update
wp core versionTake a tested backup first. Do not run this blindly on multisite installations, immutable or containerized deployments, Composer-managed WordPress, or systems whose files are controlled by a deployment pipeline. Use the normal deployment process in those environments.
Recommended Free Tools
Verify automatic and managed updates
Managed hosting may apply the update centrally, but site owners should still verify:
- The version shown under Dashboard → Updates and Dashboard → Home
- The hosting control panel’s reported WordPress version
- The deployment or file-modification timestamp
- Whether filesystem permissions, disk space, maintenance mode, or host-level version pinning interrupted the update
On a multisite network, check the shared core installation and confirm that the network is running the intended release. A custom fork may contain a backported fix without changing the upstream version; request written confirmation from the vendor and verify the patch.
Is updating enough?
Updating closes the known vulnerable code path, but it does not remove changes made before the patch. If a site was exposed while vulnerable, assess it separately for compromise.
Rank #3
- Patch status: Is the site running 7.0.2, 6.9.5, or 6.8.6?
- Exposure status: Was it internet-facing while a vulnerable version was installed?
- Compromise status: Is there evidence of unauthorized access or modification?
Possible persistence includes web shells, malicious administrator accounts, unauthorized plugins or themes, modified core files, injected JavaScript, database backdoors, and stolen credentials.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How to check for compromise
- Preserve relevant logs and, where possible, take a forensic snapshot before deleting suspicious files.
- Review web-server access logs around the disclosure and patch period, including unusual POST requests to WordPress REST API endpoints and malformed or unexpected batch requests.
- Review users and user metadata for newly created or unexplained administrator accounts.
- Compare WordPress core files with clean files from the corresponding official release.
- Inspect recently modified PHP files in
wp-content/uploads,wp-content/mu-plugins,wp-content/plugins, andwp-content/themes. - Check scheduled tasks, cron entries, persistent must-use plugins, database options, and injected code.
- Rotate WordPress, hosting, database, SSH, API, and other relevant credentials. Regenerate WordPress salts if compromise is suspected.
- Contact the hosting provider or an incident-response specialist if there is evidence of code execution or persistent access.
Do not immediately delete suspicious files if an investigation may be needed; preserve logs and a copy first. A scanner can help identify anomalies, but no plugin-only scan proves that a site is clean.
What if the update fails?
- Record the current version and preserve update and server logs.
- Take a verified backup or hosting snapshot.
- Ask the host whether the installation is managed or version-pinned.
- Retry with the official release package or the site’s approved deployment mechanism.
- Compare core files with a clean release and investigate mixed or incomplete files.
- Treat unexplained update failures on an exposed site as a possible compromise signal.
Common causes include insufficient filesystem permissions, exhausted disk space or inodes, failed database updates, plugin incompatibilities, and compromised files blocking the update.
Rank #4
Temporary measures for sites that cannot be patched
Until the update is completed, consider restricting access to login and administration interfaces, placing the site behind a properly configured WAF, asking the host about server-side mitigation, or taking a high-value site offline temporarily.
Restricting or disabling REST API access may reduce exposure only when the site does not need it. It can break the block editor, mobile apps, headless front ends, WooCommerce, forms, analytics, and other integrations. A WAF can provide temporary containment, but it is not a substitute for patching and may produce false positives or be bypassed.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDo security plugins protect against this?
Security plugins may provide vulnerability alerts, file-integrity monitoring, login protection, malware scanning, firewall rules, and event logging. Those are useful additional layers, but they do not make an unpatched WordPress core installation equivalent to a patched one. Detection may be delayed, configuration may be incomplete, and a plugin may not inspect traffic before it reaches the server.
Best Value
For individual sites, prompt updates, strong authentication, tested backups, and basic monitoring may be sufficient. Agencies and businesses managing many sites may benefit from centralized patch management, fleet-wide alerts, edge filtering, or managed incident response. Products such as Wordfence, Cloudflare’s WAF, and Sucuri address different needs; none replaces the WordPress core update.
What “millions of websites” really means
WordPress’s large installed base makes broad potential exposure plausible, but no verified global count of vulnerable live websites is established by the cited official material. Potentially vulnerable installations are not the same as internet-facing sites, targeted sites, or compromised sites.
Third-party researchers have used the name “WP2SHELL” and reported active exploitation. Those claims should be treated as third-party reporting rather than definitive confirmation from the official WordPress advisory. The official sources confirm the fixes and affected branches, not the number of attacks or compromises. See the Femtosec technical overview for that attribution.
Technical scope
WordPress’s documentation lists revised core files including /wp-includes/rest-api/class-wp-rest-server.php, /wp-includes/class-wp-query.php, and /wp-includes/rest-api.php. These details can help security teams scope review, but they are not a reason to publish or use exploit payloads.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
