Critical WordPress vulnerability: Update immediately
Attackers are chaining two flaws to enable remote code execution
1Emergency: Critical flaw in WordPress
WordPress released patches for two severe security vulnerabilities. When chained together, these flaws allow attackers to execute code without authentication. Experts report active exploitation attempts began just hours after the patches were released.
2How the vulnerabilities work
The first flaw (CVE-2026-60137) is a medium-severity SQL injection issue. The second (CVE-2026-63030) is a critical REST API route confusion bug. This error causes WordPress to misidentify validated requests and trust requests that should be blocked.
3Widespread impact and AI factor
Security researchers note organizations of all sizes and sectors are affected. Interestingly, attackers quickly developed exploit code potentially with AI assistance. One team reproduced the exploit minutes after disclosure.
4Forced updates activated
Due to the severity, WordPress security team enabled forced auto-updates. Versions 6.9.5 and 6.8.6 contain the fixes. WordPress core developer John Blackbourn urged users to update immediately.
5Attack progression
Throughout the weekend, attackers targeted all accessible WordPress sites globally. Thousands of exploitation attempts were recorded. After creating backdoor admin accounts, attackers installed fake plugins to fully compromise systems.
6Post-patch checks essential
Experts emphasize checking WordPress instances for new admin accounts, malicious plugins or suspicious files even after patching. Organizations waiting until Tuesday to patch are likely already compromised.