Urgent CMS Warning: WordPress Releases Emergency Security Update 6.9.5 to Patch Core Pre-Auth RCE and SQL Injection Flaws
Executive Summary
WordPress has officially released an emergency security update, version 6.9.5, to patch two critical, high-severity vulnerabilities affecting core components of the content management system (CMS). Disclosed on July 18, 2026, the vulnerabilities—tracked as CVE-2026-63030 and CVE-2026-60137—represent an immediate, severe threat to WordPress-powered web applications globally. If left unpatched, unauthenticated remote attackers can exploit these flaws to bypass internal database validation gates, execute arbitrary SQL commands, write persistent web shells directly into server directories, and achieve complete Remote Code Execution (RCE). Because public, working proof-of-concept (PoC) exploit scripts are already circulating in the wild, administrators are urged to apply the security patches to all affected WordPress environments immediately to prevent complete server compromise.
Deep-Dive Technical Analysis
WordPress is the most popular content management system globally, powering over 43% of all websites on the internet. Because of its massive footprint, any vulnerability affecting WordPress Core represents an extreme threat that can be leveraged by automated botnets to rapidly compromise and exploit millions of web servers.
A technical analysis of the two core vulnerabilities patched in WordPress 6.9.5 reveals highly severe database and API validation failures:
1. CVE-2026-63030 (wp2shell - Pre-Auth REST API RCE): Discovered by Adam Kues at Assetnote, this critical-severity vulnerability resides within WordPress's core REST API batch-route handling engine. When processing REST API batch requests, the system fails to enforce proper boundary separation and route isolation. An unauthenticated remote attacker can transmit a crafted JSON payload targeting specific API endpoints to trigger a route confusion. This confusion allows the attacker to execute unauthorized SQL queries, bypass internal sanitization filters, and write a malicious PHP web shell (wp-config-shell.php or similar) directly into the server’s uploads directory, achieving full, pre-authentication remote code execution.
2. CVE-2026-60137 (Core SQL Injection Flaw): Discovered by researchers TF1T, dtro, and haongo, this high-severity vulnerability involves improper sanitization of user-supplied inputs inside specific Core database query methods. By passing crafted SQL injection payloads via standard frontend query parameters, unauthenticated attackers can bypass administrative perimeters to directly query, extract, or modify the underlying database, risking complete database exfiltration and administrative credential theft.
Affected Versions Matrix
Affected Version
Patch Version
Risk Level
WordPress 6.9
6.9.5
Critical (RCE & SQLi)
WordPress 6.8
6.8.6
High (CVE-2026-63030)
WordPress 7.1 Beta
7.1 Beta 2
Critical (RCE & SQLi)
Industry Impact and Recommendations
The disclosure of two highly severe WordPress Core vulnerabilities with working public PoC exploits represents a critical threat. Automated threat actors are already actively scanning the public web, spraying exploits at WordPress installations to harvest database credentials and plant backdoors.
We recommend that all webmasters, database administrators, and corporate security leads implement the following immediate mitigations:
1. Apply WordPress Version 6.9.5 (or relevant patched version) Immediately: Force an immediate update across all active WordPress sites. If running WordPress 6.9, update to 6.9.5; if running WordPress 6.8, update to 6.8.6; if running 7.1 beta, update to 7.1 beta2.
2. Verify File and Folder Permissions: Audit and lock down directory write permissions on your web server. Ensure that the /wp-content/uploads/ and /wp-includes/ folders are heavily restricted, preventing the execution of PHP scripts inside uploads directories using secure .htaccess or Nginx configuration blocks.
3. Deploy a Web Application Firewall (WAF): Set up a robust, real-time Web Application Firewall (such as Cloudflare or Wordfence) to automatically detect, filter, and block malicious REST API batch payloads and SQL injection strings targeting WordPress endpoints.
4. Conduct Thorough System and Log Scans: Audit all server access logs and database transaction logs for unusual REST API requests targeting batch routes or SQL injection strings. Scan all system directories for newly added, unauthorized PHP files or anomalies inside standard configuration scripts.
References:
* Help Net Security — Two new high severity WordPress vulnerabilities, patch immediately!
* eSecurity Planet — Zero-Days, AI Governance Gaps, and Global Cybercrime Define This Week's Security Landscape
________________
Security Preparedness Lead: Person
Review Date: Date