Security researchers disclosed a pair of vulnerabilities late last week in WordPress, the backbone of millions of websites across the internet.
Within hours, proof-of-concept exploits had been published, with more following, while hackers were already looking to take advantage of the bugs.
In fact, according to vulnerability intelligence platform CVEmon, the vulnerabilities – CVE-2026-63030 and CVE-2026-60137 – became the top two most talked-about bugs across social media, and both are continuing to trend upward.
Ben Marr, security engineer at Intruder, the company that manages CVEmon, laid out how serious the issue is.
“Given WordPress powers approximately 43 per cent of all websites, the attack surface is enormous. Update to WordPress 6.9.5 or 7.0.2 immediately,” Marr told Cyber Daily.
“This exploit utilises a two-part vulnerability chain to achieve unauthenticated SQL injection on a stock WordPress installation with a single HTTP request. CVE-2026-60137 is the entry point – a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check.
“This flaw arises from the improper sanitisation of the ‘author__not_in’ parameter within ‘WP_Query’ when untrusted data is passed to it by a plugin or theme. This vulnerability allows crafted input to alter a database query, potentially leading to unauthorised access or manipulation of data.”
When Marr said the attack surface is enormous, he’s not kidding. A scan on attack surface management engine Shodan reveals tens of millions of WordPress installations online, and while many of them may not be vulnerable, even a small percentage represents a huge potential for exploitation.
Exploitation that, according to vulnerability-tracking firm VulnCheck, was already occurring on the evening of 17 July, the same day the vulnerabilities were disclosed.
“Public details on the vulnerabilities themselves were sparse early on, ostensibly to prevent exploitation,” VulnCheck said in a blog post last updated on 19 July.
“Since fixes were released, dozens of exploit implementations have been published, with multiple exploit variants now circulating on the internet.”
Jake Knott, watchTowr’s principal security researcher, said his firm was observing “widespread impact of this vulnerability across organisations of every size and every vertical”.
“Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens. watchTowr was able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort,” Knott said.
“After public exploit code was released, attackers began spraying the internet indiscriminately, hitting anything reachable and trying to get lucky. Our honeypots recorded tens of thousands of exploitation attempts, and more than 100 backdoor accounts created by different threat actors using variations of public tooling.”
According to Knott, attackers are deploying fake WordPress plugins to gain remote code execution, harvest credentials, or deploy additional tooling.
“In one case, we watched a threat actor repeatedly attempt to pull down Overlord RAT, a Golang-based remote access trojan,” Knott said.
“Given the speed and scale of exploitation, organisations that were ‘waiting until Monday’ to patch have a high likelihood of being compromised. Defenders need to inspect their WordPress instances for new administrator accounts, malicious plugins, or other suspicious files, regardless of whether they’ve patched.”
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.