"Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens," Jake Knott, watchTowr principal security researcher, told The Register.
How the two bugs combine to allow unauthenticated RCE
Two separate flaws in WordPress — CVE-2026-60137 and CVE-2026-63030 — were released with fixes late on a Friday, and together they permit unauthenticated remote code execution (RCE) when chained. CVE-2026-60137 is a moderate-severity SQL injection issue; CVE-2026-63030 is a critical REST API batch-route confusion bug.
Hacktron researchers summarized the batch-route confusion as a case where "the arrays containing the sub-requests, validation results, and matched handlers [become] misaligned," causing WordPress to treat requests as trusted even when they should be blocked. Individually the issues are difficult to weaponize; chained, they let an anonymous attacker escalate from data exposure to full RCE on affected installs.
Which WordPress releases are affected and how they were patched
WordPress 6.9 is affected by both vulnerabilities; WordPress 6.9.5 contains fixes for both CVEs. WordPress 6.8 is affected only by the SQL injection bug and was fixed in 6.8.6. WordPress 7.1 Beta 1 was also vulnerable, and 7.1 Beta 2 fixes both CVEs. Versions prior to 6.8 are not affected.
John Blackbourn, a WordPress core developer, recommended affected users "update your sites immediately." Because of the flaws' severity, the WordPress security team "enabled forced updates via the auto-update system for sites running affected versions," he added.
Exploit timeline: patches Friday, mass exploitation by Saturday
WordPress released patches late Friday; exploitation followed within hours. Security firms reported activity on a compressed timeline: PatchStack reported exploitation of both CVEs as of Friday night, and watchTowr researchers observed that "by the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public."
VulnCheck's research team verified more than two dozen unique proof-of-concept exploits targeting the flaw dubbed "WP2Shell" as of Sunday. watchTowr's honeypots recorded "tens of thousands of exploitation attempts," and more than 100 backdoor accounts created by different threat actors using variations of public tooling.
Observed attacker behavior and payloads
Researchers described a consistent pattern: after creating backdoor administrator accounts, attackers deployed fake WordPress plugins as a pathway to RCE, credential or secret exfiltration, or to download additional tooling. watchTowr observed attempts to pull down Overlord RAT, described in the advisory as a Golang-based remote access trojan, in at least one case.
Attackers initially leveraged public exploit code to harvest hashed credentials; once additional technical details were widely available, they moved to achieve RCE. The content management system credited Searchlight Cyber researcher Adam Kues with finding and reporting CVE-2026-63030; Kues subsequently dubbed the bug "wp2shell" and released a free wp2shell checker to help administrators determine whether their instances were vulnerable.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Apply the published patches immediately to affected WordPress versions (6.9.5, 6.8.6, or 7.1 Beta 2 as appropriate). Beyond patching, inspect instances for newly created administrator accounts, malicious or fake plugins, and other suspicious files regardless of whether a site has been updated — a specific recommendation from Jake Knott who warned that organizations delaying until Monday were "likely already compromised."
- Affected enterprises and procurement leaders: Expect widespread impact across organizations of "every size and every vertical," watchTowr reported. If your environment hosted externally reachable WordPress instances, prioritize forensic checks for exfiltration of hashed credentials and installation of backdoor accounts or remote access tooling.
- End users and site owners: Use the free wp2shell checker released by Adam Kues to verify exposure, and heed John Blackbourn's advice to update sites immediately. Note that WordPress enabled forced auto-updates for affected versions to speed remediation.
The chainable nature of the two flaws — a SQL injection working in tandem with a REST API route confusion — converted a moderate bug and a critical bug into a practical, unauthenticated RCE that attackers exploited within a day of public disclosure. Patches exist and forced updates have been enabled, but watchTowr's telemetry and VulnCheck's proof-of-concept catalog show defenders cannot assume safety from a version bump alone: active inspection for backdoors and malicious plugins is now the immediate, necessary second step.
Source: The Register — Attackers pummel critical WordPress vuln to create all sorts of mischief
