{"id":7238,"date":"2026-07-24T21:40:25","date_gmt":"2026-07-24T21:40:25","guid":{"rendered":"https:\/\/www.hostarmada.com\/blog\/?p=7238"},"modified":"2026-07-24T21:40:26","modified_gmt":"2026-07-24T21:40:26","slug":"latest-critical-wordpress-core-vulnerability","status":"publish","type":"post","link":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/","title":{"rendered":"Latest WordPress Vulnerability: Affected Versions and Fix"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The latest WordPress core vulnerability can allow an unauthenticated attacker to take control of an affected website, so site owners should update WordPress immediately.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The issue involves two vulnerabilities that can be chained together to bypass input validation, perform an SQL injection attack, create a rogue administrator account, and execute malicious code on the server.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress released security updates for the affected branches on July 17, 2026. Active exploitation began shortly afterward, which means website owners running a vulnerable version should update now and inspect their sites for signs of compromise.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_85 ez-toc-wrap-right counter-hierarchy ez-toc-counter ez-toc-transparent ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #565656;color:#565656\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #565656;color:#565656\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#What_Is_the_Latest_WordPress_Core_Vulnerability\" >What Is the Latest WordPress Core Vulnerability?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#Which_WordPress_Versions_Are_Affected\" >Which WordPress Versions Are Affected?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#Is_the_Vulnerability_Being_Actively_Exploited\" >Is the Vulnerability Being Actively Exploited?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#What_Should_WordPress_Site_Owners_Do_Now\" >What Should WordPress Site Owners Do Now?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#How_HostArmada_Customers_Can_Reduce_Their_Risk\" >How HostArmada Customers Can Reduce Their Risk<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#FAQs\" >FAQs<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"h-what-is-the-latest-wordpress-core-vulnerability\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Is_the_Latest_WordPress_Core_Vulnerability\"><\/span>What Is the Latest WordPress Core Vulnerability?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The security issue is a chain of two separate WordPress core vulnerabilities:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>CVE-2026-60137.<\/strong> An <a href=\"https:\/\/www.cloudflare.com\/learning\/security\/threats\/sql-injection\/\">SQL injection<\/a> vulnerability involving <strong>WP_Query<\/strong>.<\/li>\n\n\n\n<li><strong>CVE-2026-63030.<\/strong> A route and handler confusion vulnerability in the WordPress REST API batch endpoint.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">When combined, the two vulnerabilities can allow an attacker without an account or password to bypass normal validation and reach vulnerable database functionality.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The attack chain may lead to the creation of an unauthorized administrator account and remote code execution. This can give an attacker control over the website and allow them to install malicious plugins, modify files, redirect visitors, or create hidden backdoors.<\/p>\n\n\n\n<h2 id=\"h-which-wordpress-versions-are-affected\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Which_WordPress_Versions_Are_Affected\"><\/span>Which WordPress Versions Are Affected?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The vulnerabilities affect the following WordPress versions:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>WordPress 6.8 through 7.0.1 <\/strong>are affected by the SQL injection vulnerability.<\/li>\n\n\n\n<li><strong>WordPress 6.9 through 7.0.1<\/strong> are affected by the REST API batch endpoint vulnerability.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The security fixes are included in:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>WordPress 7.0.2<\/strong><\/li>\n\n\n\n<li><strong>WordPress 6.9.5<\/strong><\/li>\n\n\n\n<li><strong>WordPress 6.8.6<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Sites running older WordPress versions may not be affected by these specific vulnerabilities, but they can still contain other known security issues. Running a currently supported and fully updated version is the safest option.<\/p>\n\n\n\n<h2 id=\"h-is-the-vulnerability-being-actively-exploited\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Is_the_Vulnerability_Being_Actively_Exploited\"><\/span>Is the Vulnerability Being Actively Exploited?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. <a href=\"https:\/\/patchstack.com\/articles\/ninety-minutes-watching-attackers-weaponize-the-wordpress-core-rce\/\">Patchstack reported<\/a> observing the first exploitation attempts roughly 90 minutes after WordPress 7.0.2 was released.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In the days following the disclosure, Patchstack systems blocked more than 65,000 exploitation attempts from over 1,500 unique IP addresses. These requests targeted websites that were still running vulnerable WordPress versions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Around 97% of the blocked attempts targeted the WordPress REST API batch endpoint. Attackers used several URL variations and obfuscated SQL injection payloads to avoid simple filtering rules.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Most observed requests appeared to test whether websites were vulnerable. A smaller group attempted to execute the complete attack chain and create administrator accounts.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This rapid activity shows why WordPress security updates should be installed as soon as they become available.<\/p>\n\n\n\n<h2 id=\"h-what-should-wordpress-site-owners-do-now\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_Should_WordPress_Site_Owners_Do_Now\"><\/span>What Should WordPress Site Owners Do Now?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<h3 id=\"h-1-update-wordpress-core\" class=\"wp-block-heading\">1. Update WordPress Core<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Log in to your WordPress dashboard and go to <strong>Dashboard &gt; Updates<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/hostarmada.com\/tutorials\/blog-cms\/wordpress\/how-to-update-wordpress-manually-or-automatically\/\">Install the latest version available<\/a> for your WordPress branch. Confirm that your website is running WordPress 7.0.2, 6.9.5, 6.8.6, or a newer secure release.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Back up your files and database before applying an update if your website does not already use automated backups.<\/p>\n\n\n\n<h3 id=\"h-2-check-administrator-accounts\" class=\"wp-block-heading\">2. Check Administrator Accounts<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Go to <strong>Users &gt; All Users<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Review every account with the Administrator role. Remove or disable any account you do not recognize.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Do not assume an unfamiliar account is harmless. Confirm its owner before leaving it active.<\/p>\n\n\n\n<h3 id=\"h-3-review-installed-plugins\" class=\"wp-block-heading\">3. Review Installed Plugins<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Check the <strong>Plugins<\/strong> page for extensions you did not install. Attackers who obtain administrator access may upload a plugin containing a web shell or another form of persistent access.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Delete suspicious plugins only after creating a backup or preserving evidence if you plan to investigate the incident.<\/p>\n\n\n\n<h3 id=\"h-4-inspect-website-files\" class=\"wp-block-heading\">4. Inspect Website Files<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Look for recently created or modified PHP files, especially inside directories where PHP files would not normally appear.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pay particular attention to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\/wp-content\/uploads\/<\/strong><\/li>\n\n\n\n<li><strong>\/wp-content\/plugins\/<\/strong><\/li>\n\n\n\n<li><strong>\/wp-content\/themes\/<\/strong><\/li>\n\n\n\n<li>The WordPress root directory<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Unexpected PHP files inside the uploads directory are a strong warning sign.<\/p>\n\n\n\n<h3 id=\"h-5-review-access-and-security-logs\" class=\"wp-block-heading\">5. Review Access and Security Logs<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Search your logs for requests involving:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>\/wp-json\/batch\/v1<\/strong><\/li>\n\n\n\n<li><strong>rest_route=\/batch\/v1<\/strong><\/li>\n\n\n\n<li>Unusual POST requests to \/<\/li>\n\n\n\n<li>The <strong>author_exclude<\/strong> parameter<\/li>\n\n\n\n<li>Requests containing nested <strong>requests<\/strong> arrays<\/li>\n\n\n\n<li>Unexpected calls to <strong>\/wp\/v2\/users<\/strong><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Remember that the batch route may appear in the POST body rather than the URL. A log search that checks only request paths may miss relevant activity.<\/p>\n\n\n\n<h3 id=\"h-6-reset-credentials-after-a-suspected-compromise\" class=\"wp-block-heading\">6. Reset Credentials After a Suspected Compromise<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If you find evidence that the site was compromised, reset:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>WordPress administrator passwords<\/li>\n\n\n\n<li>Hosting account passwords<\/li>\n\n\n\n<li>SFTP and SSH credentials<\/li>\n\n\n\n<li>Database passwords<\/li>\n\n\n\n<li>Control panel credentials<\/li>\n\n\n\n<li>API keys and application passwords<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">You should also regenerate the WordPress security salts in <strong>wp-config.php <\/strong>to invalidate active login sessions.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Updating WordPress closes the vulnerability, but it does not automatically remove administrator accounts, malicious plugins, web shells, or other backdoors that an attacker may have created earlier.<\/p>\n\n\n\n<h2 id=\"h-how-hostarmada-customers-can-reduce-their-risk\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_HostArmada_Customers_Can_Reduce_Their_Risk\"><\/span>How HostArmada Customers Can Reduce Their Risk<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keeping WordPress updated is the most important action you can take.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A secure hosting environment like <a href=\"https:\/\/hostarmada.com\/\">HostArmada<\/a> adds several more layers of protection, including: server monitoring, malware scanning, firewall rules, account isolation, backups, and tools that make recovery easier.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HostArmada customers can also purchase Armada V-Shield, a paid security add-on powered by Patchstack. It adds application-level protection by scanning WordPress core, plugins, and themes for known vulnerabilities and helping protect websites against emerging security threats.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Armada V-Shield can be purchased and activated through the HostArmada Client Area as an Addon Booster. To learn more, read <a href=\"https:\/\/www.hostarmada.com\/blog\/wordpress-hosting-security\/\">how Armada V-Shield strengthens WordPress security<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You should also confirm that WordPress core updates are enabled and review your administrator accounts. Most importantly, contact the support team if you notice suspicious files, unfamiliar users, unexpected redirects, or unusual website behavior.<\/p>\n\n\n\n<h2 id=\"h-faqs\" class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"FAQs\"><\/span>FAQs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1784927943668\"><strong class=\"schema-faq-question\">What is the latest WordPress core vulnerability?<\/strong> <p class=\"schema-faq-answer\">It is a chain involving CVE-2026-60137 and CVE-2026-63030. Together, the vulnerabilities can allow an unauthenticated attacker to exploit an SQL injection issue and potentially take control of a WordPress website.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1784927950231\"><strong class=\"schema-faq-question\">Which WordPress version fixes the vulnerability?<\/strong> <p class=\"schema-faq-answer\">The fixes are included in WordPress 7.0.2, 6.9.5, and 6.8.6. Later secure releases should also include the patches.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1784927950848\"><strong class=\"schema-faq-question\">Is the WordPress vulnerability being actively exploited?<\/strong> <p class=\"schema-faq-answer\">Yes. Patchstack reported detecting exploitation attempts shortly after the security update was released.<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1784927952348\"><strong class=\"schema-faq-question\">Is updating WordPress enough after an attack?<\/strong> <p class=\"schema-faq-answer\">No. Updating closes the vulnerability, but it does not remove administrator accounts, malicious plugins, altered files, or backdoors that an attacker may have already created.<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>The latest WordPress core vulnerability can allow an unauthenticated attacker to take control of an affected website, so site owners should update WordPress immediately. The issue involves two vulnerabilities that can be chained together to bypass input validation, perform an SQL injection attack, create a rogue administrator account, and execute malicious code on the server. [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":7240,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[10,17,36],"tags":[1324,1323,64,1325,1320,133,1318,1319,1321,1326,681,1322],"class_list":["post-7238","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-announcements","category-news","category-wordpress","tag-cve-2026-60137","tag-cve-2026-63030","tag-cybersecurity","tag-rest-api-vulnerability","tag-sql-injection","tag-website-security","tag-wordpress-core","tag-wordpress-exploit","tag-wordpress-security-update","tag-wordpress-tags-wordpress-security","tag-wordpress-update","tag-wordpress-vulnerability"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.9 (Yoast SEO v27.9) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Latest WordPress Vulnerability: Affected Versions and Fix<\/title>\n<meta name=\"description\" content=\"A critical WordPress core vulnerability is under active attack. Update now, review affected versions, and check your site for signs of compromise.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Latest WordPress Vulnerability: Affected Versions and Fix\" \/>\n<meta property=\"og:description\" content=\"A critical WordPress core vulnerability is under active attack. Update now, review affected versions, and check your site for signs of compromise.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/\" \/>\n<meta property=\"og:site_name\" content=\"HostArmada Blog\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-24T21:40:25+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-24T21:40:26+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/07\/wp-core-vulnerability.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2400\" \/>\n\t<meta property=\"og:image:height\" content=\"1200\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Emman Zahid\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Emman Zahid\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/\"},\"author\":{\"name\":\"Emman Zahid\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#\\\/schema\\\/person\\\/49bb87cc02a12993309187df4000dd9e\"},\"headline\":\"Latest WordPress Vulnerability: Affected Versions and Fix\",\"datePublished\":\"2026-07-24T21:40:25+00:00\",\"dateModified\":\"2026-07-24T21:40:26+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/\"},\"wordCount\":992,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/wp-core-vulnerability.png\",\"keywords\":[\"CVE-2026-60137\",\"CVE-2026-63030\",\"Cybersecurity\",\"REST API Vulnerability\",\"SQL Injection\",\"website security\",\"WordPress Core\",\"WordPress Exploit\",\"WordPress Security Update\",\"WordPress tags: WordPress Security\",\"wordpress update\",\"WordPress Vulnerability\"],\"articleSection\":[\"Announcements\",\"News\",\"WordPress\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#respond\"]}]},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/\",\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/\",\"name\":\"Latest WordPress Vulnerability: Affected Versions and Fix\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/wp-core-vulnerability.png\",\"datePublished\":\"2026-07-24T21:40:25+00:00\",\"dateModified\":\"2026-07-24T21:40:26+00:00\",\"description\":\"A critical WordPress core vulnerability is under active attack. Update now, review affected versions, and check your site for signs of compromise.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927943668\"},{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927950231\"},{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927950848\"},{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927952348\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/wp-core-vulnerability.png\",\"contentUrl\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/wp-core-vulnerability.png\",\"width\":2400,\"height\":1200,\"caption\":\"Critical WordPress Core Vulnerability\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"HostArmada Blog\",\"item\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Latest WordPress Vulnerability: Affected Versions and Fix\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/\",\"name\":\"HostArmada Blog\",\"description\":\"HostArmada official blog. Useful web hosting related articles.\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#organization\",\"name\":\"HostArmada Blog\",\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Group-7823.png\",\"contentUrl\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/06\\\/Group-7823.png\",\"width\":240,\"height\":25,\"caption\":\"HostArmada Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/#\\\/schema\\\/person\\\/49bb87cc02a12993309187df4000dd9e\",\"name\":\"Emman Zahid\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e9936c90bf33f64b28ad90e22f2b5f4ad60bf036a7d2849a9655323ba4d7f28?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e9936c90bf33f64b28ad90e22f2b5f4ad60bf036a7d2849a9655323ba4d7f28?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5e9936c90bf33f64b28ad90e22f2b5f4ad60bf036a7d2849a9655323ba4d7f28?s=96&d=mm&r=g\",\"caption\":\"Emman Zahid\"},\"description\":\"Emman is a Content Manager at HostArmada where she helps make complex topics accessible for readers around the world. With 5+ years of experience in crafting SEO content, she\u2019s passionate about making tech topics easy to understand. In her free time, Emman enjoys traveling and watching Formula 1\\\/E races.\",\"sameAs\":[\"https:\\\/\\\/hostarmada.com\"],\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/author\\\/emman-ha\\\/\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927943668\",\"position\":1,\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927943668\",\"name\":\"What is the latest WordPress core vulnerability?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It is a chain involving CVE-2026-60137 and CVE-2026-63030. Together, the vulnerabilities can allow an unauthenticated attacker to exploit an SQL injection issue and potentially take control of a WordPress website.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927950231\",\"position\":2,\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927950231\",\"name\":\"Which WordPress version fixes the vulnerability?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The fixes are included in WordPress 7.0.2, 6.9.5, and 6.8.6. Later secure releases should also include the patches.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927950848\",\"position\":3,\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927950848\",\"name\":\"Is the WordPress vulnerability being actively exploited?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes. Patchstack reported detecting exploitation attempts shortly after the security update was released.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927952348\",\"position\":4,\"url\":\"https:\\\/\\\/www.hostarmada.com\\\/blog\\\/latest-critical-wordpress-core-vulnerability\\\/#faq-question-1784927952348\",\"name\":\"Is updating WordPress enough after an attack?\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. Updating closes the vulnerability, but it does not remove administrator accounts, malicious plugins, altered files, or backdoors that an attacker may have already created.\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Latest WordPress Vulnerability: Affected Versions and Fix","description":"A critical WordPress core vulnerability is under active attack. Update now, review affected versions, and check your site for signs of compromise.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/","og_locale":"en_US","og_type":"article","og_title":"Latest WordPress Vulnerability: Affected Versions and Fix","og_description":"A critical WordPress core vulnerability is under active attack. Update now, review affected versions, and check your site for signs of compromise.","og_url":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/","og_site_name":"HostArmada Blog","article_published_time":"2026-07-24T21:40:25+00:00","article_modified_time":"2026-07-24T21:40:26+00:00","og_image":[{"width":2400,"height":1200,"url":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/07\/wp-core-vulnerability.png","type":"image\/png"}],"author":"Emman Zahid","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Emman Zahid","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#article","isPartOf":{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/"},"author":{"name":"Emman Zahid","@id":"https:\/\/www.hostarmada.com\/blog\/#\/schema\/person\/49bb87cc02a12993309187df4000dd9e"},"headline":"Latest WordPress Vulnerability: Affected Versions and Fix","datePublished":"2026-07-24T21:40:25+00:00","dateModified":"2026-07-24T21:40:26+00:00","mainEntityOfPage":{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/"},"wordCount":992,"commentCount":0,"publisher":{"@id":"https:\/\/www.hostarmada.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/07\/wp-core-vulnerability.png","keywords":["CVE-2026-60137","CVE-2026-63030","Cybersecurity","REST API Vulnerability","SQL Injection","website security","WordPress Core","WordPress Exploit","WordPress Security Update","WordPress tags: WordPress Security","wordpress update","WordPress Vulnerability"],"articleSection":["Announcements","News","WordPress"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/","url":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/","name":"Latest WordPress Vulnerability: Affected Versions and Fix","isPartOf":{"@id":"https:\/\/www.hostarmada.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#primaryimage"},"image":{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#primaryimage"},"thumbnailUrl":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/07\/wp-core-vulnerability.png","datePublished":"2026-07-24T21:40:25+00:00","dateModified":"2026-07-24T21:40:26+00:00","description":"A critical WordPress core vulnerability is under active attack. Update now, review affected versions, and check your site for signs of compromise.","breadcrumb":{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927943668"},{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927950231"},{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927950848"},{"@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927952348"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#primaryimage","url":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/07\/wp-core-vulnerability.png","contentUrl":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/07\/wp-core-vulnerability.png","width":2400,"height":1200,"caption":"Critical WordPress Core Vulnerability"},{"@type":"BreadcrumbList","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"HostArmada Blog","item":"https:\/\/www.hostarmada.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Latest WordPress Vulnerability: Affected Versions and Fix"}]},{"@type":"WebSite","@id":"https:\/\/www.hostarmada.com\/blog\/#website","url":"https:\/\/www.hostarmada.com\/blog\/","name":"HostArmada Blog","description":"HostArmada official blog. Useful web hosting related articles.","publisher":{"@id":"https:\/\/www.hostarmada.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.hostarmada.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.hostarmada.com\/blog\/#organization","name":"HostArmada Blog","url":"https:\/\/www.hostarmada.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.hostarmada.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/06\/Group-7823.png","contentUrl":"https:\/\/www.hostarmada.com\/blog\/wp-content\/uploads\/2026\/06\/Group-7823.png","width":240,"height":25,"caption":"HostArmada Blog"},"image":{"@id":"https:\/\/www.hostarmada.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.hostarmada.com\/blog\/#\/schema\/person\/49bb87cc02a12993309187df4000dd9e","name":"Emman Zahid","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5e9936c90bf33f64b28ad90e22f2b5f4ad60bf036a7d2849a9655323ba4d7f28?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5e9936c90bf33f64b28ad90e22f2b5f4ad60bf036a7d2849a9655323ba4d7f28?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5e9936c90bf33f64b28ad90e22f2b5f4ad60bf036a7d2849a9655323ba4d7f28?s=96&d=mm&r=g","caption":"Emman Zahid"},"description":"Emman is a Content Manager at HostArmada where she helps make complex topics accessible for readers around the world. With 5+ years of experience in crafting SEO content, she\u2019s passionate about making tech topics easy to understand. In her free time, Emman enjoys traveling and watching Formula 1\/E races.","sameAs":["https:\/\/hostarmada.com"],"url":"https:\/\/www.hostarmada.com\/blog\/author\/emman-ha\/"},{"@type":"Question","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927943668","position":1,"url":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927943668","name":"What is the latest WordPress core vulnerability?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"It is a chain involving CVE-2026-60137 and CVE-2026-63030. Together, the vulnerabilities can allow an unauthenticated attacker to exploit an SQL injection issue and potentially take control of a WordPress website.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927950231","position":2,"url":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927950231","name":"Which WordPress version fixes the vulnerability?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The fixes are included in WordPress 7.0.2, 6.9.5, and 6.8.6. Later secure releases should also include the patches.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927950848","position":3,"url":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927950848","name":"Is the WordPress vulnerability being actively exploited?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes. Patchstack reported detecting exploitation attempts shortly after the security update was released.","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927952348","position":4,"url":"https:\/\/www.hostarmada.com\/blog\/latest-critical-wordpress-core-vulnerability\/#faq-question-1784927952348","name":"Is updating WordPress enough after an attack?","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"No. Updating closes the vulnerability, but it does not remove administrator accounts, malicious plugins, altered files, or backdoors that an attacker may have already created.","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"_links":{"self":[{"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/posts\/7238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/comments?post=7238"}],"version-history":[{"count":2,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/posts\/7238\/revisions"}],"predecessor-version":[{"id":7241,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/posts\/7238\/revisions\/7241"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/media\/7240"}],"wp:attachment":[{"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/media?parent=7238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/categories?post=7238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hostarmada.com\/blog\/wp-json\/wp\/v2\/tags?post=7238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}