CISA Warns of Actively Exploited WordPress Flaws Enabling Pre-Auth RCE

CISA has added two chained WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaws enable unauthenticated, pre-auth remote code execution (RCE) on default WordPress installations now being actively targeted. The flaw CVE-2026-63030, dubbed “wp2shell”, is a pre-authentication RCE vulnerability that impacts WordPress Core 6.8.x, 6.9.x and 7.0.x […] The post CISA Warns of Actively Exploited WordPress Flaws Enabling Pre-Auth RCE appeared first on Cyber Security News.

CISA has added two chained WordPress Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, to its Known Exploited Vulnerabilities (KEV) catalog, warning that the flaws enable unauthenticated, pre-auth remote code execution (RCE) on default WordPress installations now being actively targeted. The flaw CVE-2026-63030, dubbed “wp2shell”, is a pre-authentication RCE vulnerability that impacts WordPress Core 6.8.x, 6.9.x and 7.0.x prior to the latest security releases. The bug is reachable via a single anonymous POST request to the REST API batch endpoint, allowing an attacker with no credentials to interact with core functionality on exposed sites. CISA Warns of WordPress Flaws Exploited CISA’s listing states that exploitation has moved beyond proof-of-concept, prompting accelerated patch deadlines for federal agencies under Binding Operational Directive (BOD) 26-04. The flaw is rooted in an interpretation conflict in WordPress Core’s handling of REST API routes, leading to a route confusion condition mapped to CWE-436. Under the right conditions, the confusion lets crafted requests reach internal query logic in ways the original security model did not anticipate, creating a critical pivot point for attackers. Because the vulnerable code exists in Core itself, even “bare” WordPress deployments without plugins or custom themes remain directly exploitable if exposed to the internet. The flaw CVE-2026-60137 is triggered when plugins or themes pass untrusted input into Core query parameters, allowing attackers to manipulate the underlying SQL queries. Researchers show that via the REST batch endpoint, an attacker can reach this SQL injection and escalate from database-level tampering to arbitrary PHP code execution on the server. Security vendors describe the chain as giving direct, unauthenticated access to a default WordPress site, removing the need for weak credentials, plugin bugs, or multi-stage social engineering. While active use in ransomware campaigns is not yet confirmed, CISA’s KEV inclusion and short remediation windows signal concern that opportunistic actors will quickly operationalize the exploit in mass scanning and automated compromise. Federal agencies ordered to patch Under BOD 26-04, federal civilian agencies must prioritize patching based on evidence of exploitation rather than severity labels, and must perform forensics triage to assess compromise before or alongside patching. CISA set an initial due date of July 24, 2026 for CVE-2026-63030 and August 4, 2026 for CVE-2026-60137, reflecting the urgency of closing both ends of the exploit chain. WordPress has released fixed versions 6.8.6, 6.9.5 and 7.0.2, with forced automatic updates enabled for many affected sites, but CISA stresses that administrators must verify that upgrades have successfully completed. For environments where immediate patching is not feasible, temporary mitigations include blocking requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 at web application firewalls or load balancers to reduce exposure to pre-auth exploit traffic. Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN. The post CISA Warns of Actively Exploited WordPress Flaws Enabling Pre-Auth RCE appeared first on Cyber Security News.