The latest WordPress core vulnerability can allow an unauthenticated attacker to take control of an affected website, so site owners should update WordPress immediately.

The issue involves two vulnerabilities that can be chained together to bypass input validation, perform an SQL injection attack, create a rogue administrator account, and execute malicious code on the server.

WordPress released security updates for the affected branches on July 17, 2026. Active exploitation began shortly afterward, which means website owners running a vulnerable version should update now and inspect their sites for signs of compromise.

What Is the Latest WordPress Core Vulnerability?

The security issue is a chain of two separate WordPress core vulnerabilities:

1. CVE-2026-60137. An SQL injection vulnerability involving WP_Query.
2. CVE-2026-63030. A route and handler confusion vulnerability in the WordPress REST API batch endpoint.

When combined, the two vulnerabilities can allow an attacker without an account or password to bypass normal validation and reach vulnerable database functionality.

The attack chain may lead to the creation of an unauthorized administrator account and remote code execution. This can give an attacker control over the website and allow them to install malicious plugins, modify files, redirect visitors, or create hidden backdoors.

Which WordPress Versions Are Affected?

The vulnerabilities affect the following WordPress versions:

• WordPress 6.8 through 7.0.1 are affected by the SQL injection vulnerability.
• WordPress 6.9 through 7.0.1 are affected by the REST API batch endpoint vulnerability.

The security fixes are included in:

• WordPress 7.0.2
• WordPress 6.9.5
• WordPress 6.8.6

Sites running older WordPress versions may not be affected by these specific vulnerabilities, but they can still contain other known security issues. Running a currently supported and fully updated version is the safest option.

Is the Vulnerability Being Actively Exploited?

Yes. Patchstack reported observing the first exploitation attempts roughly 90 minutes after WordPress 7.0.2 was released.

In the days following the disclosure, Patchstack systems blocked more than 65,000 exploitation attempts from over 1,500 unique IP addresses. These requests targeted websites that were still running vulnerable WordPress versions.

Around 97% of the blocked attempts targeted the WordPress REST API batch endpoint. Attackers used several URL variations and obfuscated SQL injection payloads to avoid simple filtering rules.

Most observed requests appeared to test whether websites were vulnerable. A smaller group attempted to execute the complete attack chain and create administrator accounts.

This rapid activity shows why WordPress security updates should be installed as soon as they become available.

What Should WordPress Site Owners Do Now?

1. Update WordPress Core

Log in to your WordPress dashboard and go to Dashboard > Updates.

Install the latest version available for your WordPress branch. Confirm that your website is running WordPress 7.0.2, 6.9.5, 6.8.6, or a newer secure release.

Back up your files and database before applying an update if your website does not already use automated backups.

2. Check Administrator Accounts

Go to Users > All Users.

Review every account with the Administrator role. Remove or disable any account you do not recognize.

Do not assume an unfamiliar account is harmless. Confirm its owner before leaving it active.

3. Review Installed Plugins

Check the Plugins page for extensions you did not install. Attackers who obtain administrator access may upload a plugin containing a web shell or another form of persistent access.

Delete suspicious plugins only after creating a backup or preserving evidence if you plan to investigate the incident.

4. Inspect Website Files

Look for recently created or modified PHP files, especially inside directories where PHP files would not normally appear.

Pay particular attention to:

• /wp-content/uploads/
• /wp-content/plugins/
• /wp-content/themes/
• The WordPress root directory

Unexpected PHP files inside the uploads directory are a strong warning sign.

5. Review Access and Security Logs

Search your logs for requests involving:

• /wp-json/batch/v1
• rest_route=/batch/v1
• Unusual POST requests to /
• The author_exclude parameter
• Requests containing nested requests arrays
• Unexpected calls to /wp/v2/users

Remember that the batch route may appear in the POST body rather than the URL. A log search that checks only request paths may miss relevant activity.

6. Reset Credentials After a Suspected Compromise

If you find evidence that the site was compromised, reset:

• WordPress administrator passwords
• Hosting account passwords
• SFTP and SSH credentials
• Database passwords
• Control panel credentials
• API keys and application passwords

You should also regenerate the WordPress security salts in wp-config.php to invalidate active login sessions.

Updating WordPress closes the vulnerability, but it does not automatically remove administrator accounts, malicious plugins, web shells, or other backdoors that an attacker may have created earlier.

How HostArmada Customers Can Reduce Their Risk

Keeping WordPress updated is the most important action you can take.

A secure hosting environment like HostArmada adds several more layers of protection, including: server monitoring, malware scanning, firewall rules, account isolation, backups, and tools that make recovery easier.

HostArmada customers can also purchase Armada V-Shield, a paid security add-on powered by Patchstack. It adds application-level protection by scanning WordPress core, plugins, and themes for known vulnerabilities and helping protect websites against emerging security threats.

Armada V-Shield can be purchased and activated through the HostArmada Client Area as an Addon Booster. To learn more, read how Armada V-Shield strengthens WordPress security.

You should also confirm that WordPress core updates are enabled and review your administrator accounts. Most importantly, contact the support team if you notice suspicious files, unfamiliar users, unexpected redirects, or unusual website behavior.

FAQs