CVE-2026-63030, CVE-2026-60137: WordPress Core — Pre-Auth RCE in the Wild (July 2026)

CVE-2026-63030, CVE-2026-60137 — WordPress Core

Two critical vulnerabilities, CVE-2026-63030 and CVE-2026-60137, have been identified in WordPress Core, enabling pre-authenticated remote code execution (RCE) on standard installations. Both flaws are being actively exploited in the wild, with public exploit code circulating and no plugin dependencies required for compromise.

Attack Vector

Attackers leverage a chain involving both CVEs to remotely execute arbitrary code without authentication on unpatched WordPress sites. The exploit does not require any plugins or special configuration, affecting default WordPress deployments. Malicious actors are observed deploying webshells and persistent backdoors, with attack traffic originating from multiple global IP ranges. Indicators of compromise include unexpected PHP files in webroot directories and anomalous POST requests to core WordPress endpoints.

Who Is at Risk

All organizations running WordPress Core, regardless of version or plugin usage, are at risk. The vulnerability impacts standard installations globally, including those with default configurations. WordPress itself is confirmed affected, and the scale of exposure is estimated in the hundreds of millions of websites. Auto-patching mechanisms are not yet fully deployed, leaving a significant portion of sites vulnerable.

Patch & Mitigate

• Patch: Apply the latest WordPress Core security update immediately. Monitor for emergency hotfixes released after July 2026.
• Workaround: Restrict public access to wp-admin and wp-login.php where feasible. Consider deploying a web application firewall with custom rules to block suspicious POST requests.
• Detect: Audit logs for unauthorized file creation in webroot, unexpected PHP execution, and anomalous POST requests to /wp-admin/ and /xmlrpc.php endpoints.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the RCE flaw to gain an initial foothold on WordPress servers.
• TA0005 — Defense Evasion: Webshells and backdoors are deployed to evade detection and maintain persistence.

Source: https://thehackernews.com/2026/07/weekly-recap-wordpress-rce-sonicwall-0.html