How to Fix CVE-2026-63030 and CVE-2026-60137

WordPress has released urgent security updates addressing two vulnerabilities in WordPress core. If your website is running an affected version, it should be updated now.

The issues are tracked as CVE-2026-60137 and CVE-2026-63030. When combined on affected WordPress 6.9 and 7.0 websites, they can allow an attacker without a login to execute code on the server. This could lead to a website being taken over, data being accessed or malicious files being installed.

How did the wp2shell vulnerability happen?

The critical issue, commonly called wp2shell, is a chain of two separate weaknesses in WordPress core.

1. CVE-2026-60137 affects database queries. Crafted input could alter a WordPress database query through the author__not_in parameter used by WP_Query. This SQL injection issue is present in WordPress 6.8 and later.
2. CVE-2026-63030 affects the REST API batch endpoint. A route-confusion weakness introduced in WordPress 6.9 could expose the database-query flaw through a public REST API request.
3. The two flaws could be chained. On affected WordPress 6.9 and 7.0 websites, an anonymous attacker could combine them to move from a crafted request to remote code execution. No WordPress login or vulnerable plugin was required.

Cloudflare reports that the remote-code-execution path applies when a persistent object cache is not in use, which is a common configuration. WordPress and the researchers initially limited detailed exploit information to give website owners time to update.

The REST API issue was discovered and responsibly disclosed by Adam Kues at Assetnote and Searchlight Cyber. The SQL injection issue was separately reported by researchers TF1T, dtro and haongo. WordPress coordinated fixes with hosting and security providers before releasing the patched versions on 17 July 2026.

Which WordPress versions need updating?

Check the version shown in your WordPress Dashboard under Dashboard > Updates.

• WordPress 6.8.0 to 6.8.5 should be updated to 6.8.6.
• WordPress 6.9.0 to 6.9.4 should be updated to 6.9.5.
• WordPress 7.0.0 to 7.0.1 should be updated to 7.0.2.

WordPress versions before 6.8 are not affected by these two vulnerabilities. Sites already running 6.8.6, 6.9.5 or 7.0.2 contain the relevant security fixes.

Why this update is urgent

Most WordPress security problems involve a plugin or theme. These vulnerabilities are different because they affect WordPress core itself.

CVE-2026-60137 is an SQL injection issue affecting WordPress 6.8 and later. CVE-2026-63030 is a REST API batch-route issue affecting WordPress 6.9 and later. On affected 6.9 and 7.0 websites, the two issues can be combined to achieve remote code execution without an authenticated account.

WordPress classifies the combined issue as critical and recommends updating immediately. Due to its severity, WordPress also enabled forced automatic updates for affected versions. Website owners should still confirm that the update completed successfully rather than assuming it did.

What website owners should do now

1. Confirm your WordPress version. Log in and open Dashboard > Updates.
2. Take a current backup. Make sure both the website files and database are included.
3. Install the appropriate security update. Use 6.8.6, 6.9.5, 7.0.2 or a newer supported release.
4. Check the website after updating. Test important forms, checkout functions and other key pages.
5. Review the site for unexpected changes. Look for unfamiliar administrator accounts, unknown plugins or themes, modified PHP files and unexplained database changes.

If your site was running a vulnerable version, installing the update closes the known vulnerability but does not reverse an earlier compromise. A security review is sensible if you notice unexpected files, users, redirects, warnings or other unusual behaviour.

How we updated hundreds of WordPress websites

We used WP-CLI to apply the security update across several hundred websites. This process can be automated and may avoid restrictions that only block updates through the WordPress dashboard.

First, check the installed WordPress version:

wp core version

Then install the patched release for the website’s existing branch:

wp core update --version=6.8.6
wp core update --version=6.9.5
wp core update --version=7.0.2

Use only the command that matches the website’s current 6.8, 6.9 or 7.0 branch. Do not run all three commands on the same website. After updating, run wp core version again and confirm the site is working correctly.

At larger scale, the version check can be used to select the correct update automatically. Backups, error logging and post-update checks should be built into the automation rather than treating a successful command as the only confirmation.

How to test a WordPress website

The safest and most reliable check is the installed WordPress version. If you have command-line access, run:

# Check the installed WordPress core version.
wp core version

If you only have public web access, the version may appear in the homepage generator tag:

# Replace example.com with a website you own or manage.
curl -sL https://example.com/ | grep -oiE 'content="WordPress [0-9.]+"' | head -1

Many well-configured websites remove this tag, so an empty result means the version is unknown, not that the website is safe.

Check whether anonymous batch requests are blocked

You can send a harmless empty request to both forms of the REST API batch route:

# Test the direct REST API route without sending an exploit payload.
curl -i -X POST -H 'Content-Type: application/json' \
  --data '{"requests":[]}' \
  https://example.com/wp-json/batch/v1

# Test the query-string form because a mitigation must cover both routes.
curl -i -X POST -H 'Content-Type: application/json' \
  --data '{"requests":[]}' \
  'https://example.com/?rest_route=/batch/v1'

• 401 or 403: anonymous access is blocked by the website, server or firewall.
• 404: the route is unavailable or hidden by the current configuration.
• 200 or 400: the endpoint responded, but this does not prove the website is vulnerable. Patched WordPress versions may still expose the legitimate batch endpoint.

Do not use an ordinary browser GET request as the test. The affected endpoint accepts POST requests, and a GET response does not confirm that a protection rule works.

Test through the web

Searchlight Cyber, the company whose researcher discovered the critical chain, provides a public checker at https://wp2shell.com/. Only scan websites you own or are authorised to test. The checker focuses on the critical wp2shell chain affecting WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1.

A scanner result is useful supporting information, but confirming the installed version and applying the official update remain the preferred response. These checks also cannot prove that a previously vulnerable website was never compromised.

Should you disable the WordPress REST API?

Disabling the entire REST API is not the recommended fix. WordPress and many plugins use it for normal editing and website features, so a broad block can cause problems without properly addressing the underlying issue.

The correct response is to install the patched WordPress version. A hosting provider or security specialist may apply a temporary, targeted rule to the affected batch endpoint when an immediate update is genuinely impossible, but this should only be a short-term measure.

Make sure automatic updates can run

Minor WordPress security releases normally update automatically on most websites. Updates can still fail or be disabled by hosting settings, file permissions, version control, custom configuration or a security plugin.

For this reason, automatic updates are useful but should not replace monitoring. Website owners should receive update notifications, maintain working backups and regularly confirm that WordPress core, plugins and themes remain supported.

Frequently asked questions

Is WordPress 6.9.5 safe from these vulnerabilities?

Yes. WordPress 6.9.5 contains the fixes for CVE-2026-60137 and CVE-2026-63030.

Is WordPress 7.0.2 patched?

Yes. WordPress 7.0.2 contains the fixes for both vulnerabilities.

Does the issue affect websites without plugins?

The critical chain affects WordPress core, so an affected 6.9 or 7.0 installation should be updated regardless of which plugins or theme it uses.

Will WordPress update automatically?

WordPress enabled forced updates for affected versions, and many sites should update automatically. You should still verify the installed version because automatic updates can be disabled or fail.

Need help checking your WordPress website?

Thrive can check your WordPress version, safely apply the update and review the website for common signs of compromise. If you manage several WordPress websites, we can also help confirm which sites are patched and which need attention.

Official references

• WordPress 7.0.2 security release
• CVE-2026-63030 advisory
• CVE-2026-60137 advisory
• WordPress update documentation
• Searchlight Cyber wp2shell advisory
• Cloudflare technical and WAF guidance