Vulnerabilities & Exploits

WordPress Core faces automated mass exploitation

Unpatched Internet-facing WordPress Core sites are already in automated attack traffic, so this is no longer a theoretical takeover path. The useful warning is not the bug itself. It is that once a site was reachable during the window, patching alone may not remove the attacker state left behind.

FortiGuard says it blocked 4,649 exploitation attempts in the past 24 hours and saw 88,452 detections over seven days. The chain combines CVE-2026-63030, a REST API batch route confusion issue, with CVE-2026-60137, a WP_Query SQL injection, and the fixed versions are 6.8.6, 6.9.5, and 7.0.2 or later.

That scale points to automated scanning and likely persistent compromise on exposed sites, not a niche proof of concept. For operators of public WordPress estates, the real risk is attacker presence that survives the patch as web shells or unauthorized admin accounts.

3 sources · Aug 3

Timeline

• Aug 4 CISA federal deadline for CVE-2026-60137
• Aug 3 Reported by INCIBE-CERT
• Jul 31 Reported by Fortinet Outbreak Alerts
• Jul 29 Reported by FortiGuard Labs Threat Signals
• Jul 24 CISA federal deadline for CVE-2026-63030 passed
• Jul 21 CVE-2026-60137 added to CISA KEV

Sources

• Aug 3 INCIBE-CERT

  Múltiples vulnerabilidades en WordPress Core

  WordPress ha publicado dos vulnerabilidades, una de severidad crítica y otra de severidad alta, que af

  original

• Jul 31 Fortinet Outbreak Alerts

  WP2Shell RCE | Outbreak Alert | FortiGuard Labs

  FortiGuard Labs continues to detect exploitation attempts targeting the WP2Shell attack chain (CVE-2026-63030 and CVE-2026-60137), a critical unaut...

  original

• Jul 29 FortiGuard Labs Threat Signals

  Threat Signal Report | FortiGuard Labs

  What is the Attack?FortiGuard Labs is observing increasing exploitation activity targeting WP2Shell, a critical unauthenticated remote code executi...

  original

Part of the PlainSec briefing for 2026-07-30

Every edition of this story: WordPress Core faces automated mass exploitation

More from today

• OWA access now survives resets and reimaging
• Ad tag compromise turns trusted sites into stealers
• One malicious page can reach Android root