On July 17, 2026, the WordPress Security Team released urgent security updates addressing a critical vulnerability chain that could allow unauthenticated attackers to take complete control of vulnerable websites. This is not a plugin vulnerability that affects a subset of sites; this flaw exists in WordPress core itself, meaning even a fresh installation with no plugins is exploitable.
Here is what every WordPress site owner needs to know and the actions you must take immediately.
The WordPress Security Team patched two security vulnerabilities that, when chained together, create a devastating attack vector.
The first vulnerability is an unauthenticated SQL injection flaw affecting WordPress versions 6.8 through 7.0.1. It exists in the author__not_in parameter of WP_Query, where insufficient escaping and inadequate query preparation allow attackers to append malicious SQL queries. This vulnerability carries a CVSS score of 7.5 (High).
The second vulnerability enables unauthenticated remote code execution (RCE) via the WordPress REST API batch request endpoint (/wp-json/batch/v1). This flaw, dubbed wp2shell, involves a route validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback. When chained with SQL injection, an attacker can execute arbitrary code on the server. This vulnerability carries a CVSS score of 9.8 (Critical).
The combination means an attacker can:
| Branch | Affected Versions | Patched Version |
|---|---|---|
| 6.8.x | 6.8.0 through 6.8.5 | 6.8.6 |
| 6.9.x | 6.9.0 through 6.9.4 | 6.9.5 |
| 7.0.x | 7.0.0 through 7.0.1 | 7.0.2 |
WordPress 6.9 was released on December 2, 2025, meaning every affected site is running a release less than eight months old. Sites on versions earlier than 6.9 are not affected by CVE-2026-63030, though they may still be vulnerable to CVE-2026-60137.
This vulnerability is exceptionally dangerous for several reasons:
No Authentication Required: Attackers do not need a valid account or any user interaction. An anonymous HTTP request can trigger the exploit against a default WordPress installation.
No Plugins Required: The vulnerable code exists in WordPress core. Even a fresh installation with zero plugins is exploitable.
Widespread Exposure: Over 500 million websites run WordPress. While not all are vulnerable, the potential attack surface is massive.
Public Proof-of-Concept Likely Imminent: Given that WordPress is an open-source project and AI models can analyse source code, security researchers believe a public proof-of-concept will be made available in a very short period of time.
The WordPress Security Team has released patched versions: 6.8.6, 6.9.5, and 7.0.2.
To update:
The WordPress team has initiated automatic updates for sites with auto-updates enabled. However, do not assume your site has been updated. Verify manually.
Even if you believe automatic updates are enabled, check your actual version:
Searchlight Cyber has proposed temporary mitigations, but these are stopgaps and should not replace updating:
/wp-json/batch/v1 and rest_route=/batch/v1 at your Web Application Firewall (WAF)/batch/v1 requestsWarning: These mitigations can break legitimate integrations. They are not a substitute for patching.
At BG Cyber Connect, we understand that keeping your WordPress site secure requires constant vigilance. Our team can:
Perform an Immediate Security Audit
We will verify your WordPress version, confirm whether you are patched, and identify any other vulnerabilities in your installation.
Implement Proactive Security Monitoring
We deploy Web Application Firewalls (WAFs) and monitoring tools that can block exploit attempts before they reach your site.
Provide Ongoing Patch Management
We monitor security advisories and ensure your site is updated promptly when critical patches are released.
Remediate Compromised Sites
If your site has already been compromised, we can help you clean it, restore clean backups, and harden your security posture.
A critical vulnerability chain in WordPress core allows unauthenticated attackers to execute code and take complete control of vulnerable sites. The patches are available, but you must act now. Do not assume automatic updates have protected you. Verify your version, update if necessary, and consider implementing professional security monitoring.
Your website is your business. Don’t leave it vulnerable.
Need Help Securing Your WordPress Site?
Contact BG Cyber Connect for an Immediate Security Assessment
Explore our comprehensive WordPress security services:
BGCC Cybersecurity Solutions
DuckDuckGo now blocks most YouTube video ads by default. For businesses relying on YouTube advertising, this shift demands attention. This article explores the growing ad-blocking trend, what it means for your reach, and how to adapt with content marketing, SEO, influencer partnerships, and a diversified strategy. Future-proof your digital marketing.
A critical unauthenticated authentication bypass vulnerability in UpdraftPlus, used on over three million active WordPress sites, allows attackers to take complete control. Tracked by Wordfence, the flaw affects versions up to 1.26.4 but only if you’ve used UpdraftCentral. The patch (1.26.5) is available. Learn how the attack works, why you must update immediately, and how BG Cyber Connect can help secure your site.
Social media management costs have surged, but not all tools deliver equal value. This hard‑hitting comparison pits Vista Social against Hootsuite, Buffer, Sprout Social, and Later across pricing, AI features, unified inbox, analytics, and user experience. Discover why Vista Social is the smart choice for SMBs and agencies in 2026.
Book Now!