WordPress core flaws CVE-2026-60137 / CVE-2026-63030: update now

Update, August 19, 2026 — both deadlines have passed, but stopping at 7.0.2 now leaves you exposed to something else

The US federal remediation deadlines have passed for both flaws (July 24 for CVE-2026-63030, August 4 for CVE-2026-60137). Checking the August 18, 2026 edition of the catalog, both entries stand exactly as first filed: no extension, no change of content. The ransomware field is still "Unknown" for both. No threat actor or campaign name has been published either.

What moved in the meantime was WordPress core itself. Two more security releases have shipped since 7.0.2: 7.0.3 on August 6 with 11 fixes, and 7.0.4 on August 12 with one more. Neither is a follow-up fix for wp2shell — they are unrelated flaws.

That is the important part. CVE-2026-64638, fixed in 7.0.3, sits on the login screen, works against visitors who are not logged in, and is rated High. So "I moved to 7.0.2, I'm done" now walks you into a different hole. The guidance for the two flaws in this article is unchanged — 6.8.6, 6.9.5 or 7.0.2 and later are fixed. But the current release as of August 19, 2026 is 7.0.4, with 6.9.7 and 6.8.8 on the older branches, and that is where you should land.

The scale of the attacks is clearer now. Japanese security vendor Cyber Security Cloud reported on August 4 that it detected 1,950,165 attack requests in the nine days from July 18 to 26 (covered by ScanNetSecurity on August 14). The United States accounted for 30.9%, and Japan came third at 9.4%, with 984 distinct Japanese IP addresses on the attacking side. On the day the fix shipped, traffic to the affected endpoint jumped 277-fold from the previous day.

There is now a record from inside a real breach as well. US host InMotion Hosting published its analysis of two customer incidents: 24 to 28 seconds from initial access to a malicious plugin being activated, 38 rogue administrator accounts on a single account, and persistence spread across nine separate layers. One site was cleaned on July 20 and reinfected on July 26. Do not stop at updating — check for administrator accounts you do not recognise, and for the string wp2shell in your access logs.

Among Japanese hosts, Xserver announced on August 6 that it had lifted its emergency traffic block — but it is keeping the block in place for domains still running a vulnerable version. If you have not updated, functionality may still be switched off on the hosting side.

One last clarification on the severity numbers. Two organisations scored these flaws and they disagree. WPScan, who found them, rates CVE-2026-60137 at 5.9 and CVE-2026-63030 at 9.8. CISA rates them 9.1 and 7.5 respectively. The table in this article uses the CISA figures. NVD has assigned no score of its own to either. The 9.8 you see in press coverage is WPScan's score for CVE-2026-63030 — any article attaching 9.8 to CVE-2026-60137 has them mixed up.

And by predicted likelihood of exploitation (EPSS), the ranking flips. As of August 18, 2026, CVE-2026-63030 sits at 0.956 — inside the top 0.2% of all CVEs — against 0.731 for CVE-2026-60137, which eased slightly on August 8 and has been flat since. CVE-2026-63030 is the entry point of the chain that reaches takeover, and CISA set its deadline 11 days earlier than the other one. It is a good reminder that a bigger severity number does not automatically mean higher priority. In Japan, meanwhile, the IPA advisory has not been revised since July 22, and JPCERT/CC has kept the issue in its weekly report rather than raising a formal alert.

Update — July 24, 2026: Exploitation scales to tens of thousands, Japan's IPA issues an alert, and the U.S. deadline lands today

The attacks have widened further. Security firm watchTowr says its sensor network recorded tens of thousands of exploitation attempts and that different attackers created more than 100 rogue administrator accounts, as reported here. In at least one case, an attempt to install a remote-access trojan (RAT) was observed. The pace has not let up: another firm's telemetry shows attack traffic continuing into the early hours of July 24 (JST). Cloud security vendor Wiz analyzed that roughly 60% of organizations running WordPress were initially affected and unpatched, and a quarter had such servers exposed to the internet.

There was movement in Japan, too. On July 22, 2026, the IPA (Information-technology Promotion Agency) issued an alert for both flaws (CVE-2026-60137 and CVE-2026-63030), urging a prompt update to 6.8.6 / 6.9.5 / 7.0.2 or later. Major hosting provider Xserver also announced server-side mitigations and a user advisory on July 22. Even if you don't manage WordPress yourself, it's worth checking your hosting provider's notices once.

Of the CISA remediation deadlines, the one for the higher-severity CVE-2026-63030 falls today, July 24, 2026 (CVE-2026-60137 is due August 4). Private sites carry the same urgency — if you haven't updated, do it now. If you're worried you've already been hit, focus on checking for unfamiliar admin accounts that have appeared and any tampering with posts or theme files (with 100-plus accounts created fraudulently, this check especially matters). Note that the catalog's "known ransomware campaign use" field is still marked "Unknown" as of this update — no specific ransom operation has been confirmed. You can follow the latest on actively exploited flaws in our CISA KEV tracker (Japanese).

Update — July 21, 2026: CISA adds it to "actively exploited" list, real-world exploitation confirmed

The situation escalated another step. On July 21, 2026, the U.S. CISA (Cybersecurity and Infrastructure Security Agency) added both flaws (CVE-2026-60137 and CVE-2026-63030) to its Known Exploited Vulnerabilities (KEV) catalog. KEV is the official list that requires U.S. federal agencies to remediate by a deadline, and a listing means the flaw is confirmed to be used in real-world attacks. The "exploitation attempts" vendors had reported since July 18 are now backed up as attacks causing real harm. Every prior WordPress-related KEV entry involved a plugin flaw; a flaw in core itself being listed is unusual, researchers note. CISA requires U.S. federal agencies to remediate CVE-2026-63030 by July 24 and CVE-2026-60137 by August 4 (private sites can use these deadlines as a benchmark for emergency response). Note that the catalog's "known ransomware campaign use" field is marked "Unknown" as of this update — no specific ransomware group is identified.

Because the "wp2shell" chain works out of the box with no login, no plugins, and no configuration changes, sites still exposed on older versions are especially at risk. If you haven't updated, make updating to 6.8.6 / 6.9.5 / 7.0.2 or later your top priority. If you want to check whether you've already been compromised, look for unfamiliar admin accounts, tampering with posts or theme files, and suspicious outbound traffic. You can follow the latest on actively exploited flaws in our CISA KEV tracker (Japanese).

Update — July 21, 2026: PoC published, exploitation attempts observed

The situation has moved since our first report (July 18). The chained attack was named "wp2shell" by its discoverer, Searchlight Cyber (Assetnote), and proof-of-concept (PoC) code has been published on GitHub since July 18. Following that, Patchstack, WatchTowr, and Hexastrike have reported real in-the-wild attack and scan attempts. As of this update, however, no one has declared a confirmed large-scale takeover campaign; vendors are watching for the shift from mass scanning to actual compromise. In response, on the same day — July 21 — the U.S. CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog (see the update above).

If you cannot update right away, one stopgap—described by Help Net Security and others—is to temporarily block anonymous access to the batch endpoint /wp-json/batch/v1 at your front-end web server or WAF (a filter that blocks malicious traffic). Note this may break integrations that use that endpoint, so treat it as a bridge only. The real fix is updating to 6.8.6 / 6.9.5 / 7.0.2 or later—unchanged from the first report.