This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] WordPress Core fixes critical wp2shell flaw

WordPress fixes two vulnerabilities, collectively referred to as wp2shell, in versions 6.9.5 and 7.0.2 [1]. According to various sources, they are already being actively exploited [2][3][4][5][6]. Chaining these vulnerabilities allows an unauthenticated remote attacker to execute arbitrary code via the WordPress REST API Batch endpoint, which may even lead to server compromise [1]. Due to the high severity, WordPress is forcing the updates on systems where they are not installed automatically [7]. However, this may not take effect in some configurations, so it is strongly recommended to verify the version. If an immediate update to the fixed version is not possible, the risk can be temporarily mitigated by following the procedure described at [1]. The same link also allows you to check whether your instance is vulnerable. A PoC for the vulnerability is available at [8].

WordPress Core - SQL injection (CVE-2026-60137)
CVSS 5.9 (Medium)

An unauthenticated remote attacker can, under certain conditions, perform an SQL injection attack [9].

The vulnerability is present in product:

  • WordPress; >=6.8.0, <6.8.6; >=6.9.0, <6.9.5; >=7.0.0, <7.0.2;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

  • CVE-2026-60137 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 17. 7. 2026.

WordPress Core - route confusion (CVE-2026-63030)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can, by sending a specially crafted HTTP request to the REST API Batch endpoint, cause a routing error (route confusion) and thereby bypass some security mechanisms [10].

The vulnerability is present in product:

  • WordPress; >=6.9.0, <6.9.5; >=7.0.0, <7.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 17. 7. 2026.

By CESNET, z.s.p.o. Michaela Ručková on 21. 7. 2026.

CESNET, z.s.p.o. Logo