Critical Vulnerabilities Addressed in WordPress Update
- WordPress has issued patches for two significant vulnerabilities: CVE‑2026‑60137 (SQL injection, medium severity) and CVE‑2026‑63030 (REST API batch-route confusion, critical severity).
- When exploited in tandem, these vulnerabilities can facilitate unauthenticated remote code execution, jeopardizing entire websites.
- Administrators are strongly advised to update to WordPress version 6.9.5 or later to safeguard against ongoing widespread attacks.
Recent research indicates that millions of WordPress sites may be vulnerable, with the two newly patched flaws currently subject to active exploitation.
The vulnerabilities addressed include an SQL injection flaw (CVE-2026-60137) rated at medium severity and a critical REST API batch-route confusion flaw (CVE-2026-63030).
The SQL injection issue, rated 5.9/10 in severity, is present in WordPress versions 6.8.x prior to 6.8.6, 6.9.x before 6.9.5, and 7.0.x leading up to 7.0.2.
In contrast, the critical severity flaw, rated at 9.8/10, affects versions 6.9.x before 6.9.5 and 7.0.x prior to 7.0.2 of the globally preeminent website creation platform.
Exploitation in Progress
As reported by The Register, the individual vulnerabilities are somewhat esoteric when isolated, thus complicating exploitation.
Yet, when combined, they enable unauthorized actors to execute malicious code remotely—a scenario that could lead to complete control over affected websites.
Security experts at Knott disclosed that the vulnerabilities were rapidly recognized and exploited by malicious entities.
The initial patch surfaced on Friday, but by the early hours of Saturday, successful exploitation was already rampant; initial attacks leveraged publicly available exploit code to extract hashed credentials, followed by remote code execution once additional information became accessible, Knott noted.
The firm illustrated widespread repercussions of this vulnerability affecting diverse organizations across multiple sectors.
It is imperative to note that these security weaknesses directly compromise WordPress itself, rather than its plugins or themes.
Given that WordPress accounts for over half of all websites globally, the urgency of this situation is underscored.
To mitigate risk, it is essential that users upgrade to WordPress version 6.9.5, which effectively rectifies both vulnerabilities.
Source link: Techradar.com.
