Two New High Severity WordPress Vulnerabilities, Patch Immediately!
This story is only covered by news sources that have yet to be evaluated by the independent media monitoring agencies we use to assess the quality and reliability of news outlets on our platform. Learn more here.8 Articles
8 Articles
WordPress 7.0.2 — Patching an Unauthenticated RCE Chain Right Now
On July 17, 2026, WordPress dropped 7.0.2 to patch a chain of two vulnerabilities — CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch route confusion → RCE). The chain is nicknamed WP2Shell. Chained together, on default installations with no plugins involved, it lets a remote attacker with no WordPress account reach full code execution. If you're running WordPress 6.8 through 7.0.1, you need to update right now. Not next week. Ri…
Help Net Security
IT Security News - cybersecurity, infosecurity newsTwo new high severity WordPress vulnerabilities, patch immediately!
The 7.0.2 WordPress security release addresses one critical and one high severity security issue. The vulnerabilities reported to the WordPress security team include: CVE-2026-60137 – A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo CVE-2026-60137 – A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber Which versions of WordPr…
Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress’s REST API and a related SQL Injection vulnerability. The WordPress security team disclosed the vulnerabilities to Cloudflare before public release so that we could prepare protections for customers. Cloudflare has deployed th…
By chaining a SQL injection and an API gap, attackers can insert code. WordPress has released an update that finds a hotfix.
Cloudflare has urgently deployed cloud-based WAF rules to block attacks targeting the high-risk remote code execution vulnerability in WordPress.
A quick but urgent heads-up for everyone running their own WordPress instance: The WordPress team has released version 7.0.2. Since this is purely a security release, you should update your installations as soon as possible. Read the full article: WordPress 7.0.2 Brings Important Security Fixes Where to follow us: Facebook, Reddit, Google News, X, Threads Want to stay up-to-date? Add us to your favorite sources on Google!
Coverage Details
Bias Distribution
- There is no tracked Bias information for the sources covering this story.
Factuality
To view factuality data please Upgrade to Premium