Millions of WordPress Websites Infected with Ransomware Globally [New]

BREAKING: A critical WordPress security crisis is actively being exploited, putting millions of websites at risk of full remote takeover by attackers even without a username or password.

The incident combines CVE-2026-63030, a REST API route-confusion flaw, with CVE-2026-60137, an SQL injection vulnerability capable of contributing to remote code execution. 

On July 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities Catalog, confirming active exploitation. 

The complete attack chain affects WordPress 6.9 through 6.9.4 and WordPress 7.0 through 7.0.1, potentially exposing website databases, administrator accounts, plugins, server files, and visitor traffic. 

WordPress 6.8 through 6.8.5 is also affected by CVE-2026-60137 (the SQL injection component) and should be updated to 6.8.6, though it is not vulnerable to the unauthenticated takeover chain described above. Updating to WordPress 6.8.6, 6.9.5, 7.0.2, or a later secured release closes the known vulnerabilities, but previously exposed websites must still be checked for rogue administrators, malicious plugins, PHP web shells, altered database records, and other persistent malware.

Recent WordPress attack at a glance

Detail	Confirmed information
Target	WordPress core
Vulnerabilities	CVE-2026-63030 and CVE-2026-60137
Public disclosure	July 17, 2026
CISA exploitation listing	July 21, 2026
Authentication required	No for the complete attack chain
User interaction required	No
Main risk	SQL injection and remote code execution
SQL-injection affected versions	WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1
Complete attack-chain versions	WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1
Secured versions	WordPress 6.8.6, 6.9.5, and 7.0.2, depending on the installed branch
Immediate action	Update, preserve evidence, investigate, clean, and monitor

How Are Hackers Taking Over WordPress Websites?

The attack works by chaining two different weaknesses. Each flaw performs a separate role.

The first vulnerability, CVE-2026-63030 (CVSS 9.8), is an interpretation conflict involving the WordPress REST API batch endpoint, reported by Adam Kues.

In simple terms, different parts of WordPress can interpret the same request differently. That confusion may allow a request to reach a function it should not be allowed to access.

The second vulnerability, CVE-2026-60137 (CVSS 5.9), is an SQL injection flaw reported by TF1T, dtro, and haongo. SQL injection happens when unsafe input reaches a database query. An attacker may then change what the database is instructed to do.

The official NIST record for CVE-2026-63030 states that combining these flaws can lead to SQL injection and remote code execution.

Remote code execution means the attacker can make the website’s server run unauthorized commands. It is one of the most serious outcomes of a web application vulnerability because it moves the incident beyond content editing or information exposure.

Once code execution is available, the hacker can install a persistent method of access. Removing the original entry point will not automatically remove that persistence.

Why is This WordPress Security Threat So Dangerous?

This incident affects WordPress core rather than one optional plugin.

A website does not need an abandoned theme or obscure extension to be exposed to the complete vulnerability chain. A standard WordPress installation running an affected core version may be at risk.

The attack is also remotely accessible. The vulnerability records indicate that no existing privileges or user interaction are required. A visitor does not need to open a malicious attachment, and an administrator does not need to approve a login.

Automated exploitation makes the threat more urgent. A malicious program can scan large numbers of public websites, identify likely WordPress installations, and send prepared requests without manually selecting each business.

The potential technical impact is extensive. Attackers who obtain code execution may gain control over website files, database access, and normal WordPress functions. The exact damage will depend on hosting permissions and the actions performed after entry.

Are Hackers Actively Targeting WordPress Websites?

Yes. CISA lists both vulnerabilities in its Known Exploited Vulnerabilities Catalog.

Inclusion in that catalog means there is evidence that attackers have exploited the vulnerabilities in real environments. It does not mean every website running an affected version has been hacked.

Small websites should still act quickly. Automated attacks generally search for technical exposure. They do not care whether a site belongs to a multinational business, a local store, an independent professional, or a personal publisher.

A less prominent site can still be useful to criminals. A compromised WordPress installation can host scam pages, redirect visitors, distribute malware, manipulate search results, or become part of a wider attack operation.

Is the Recent WordPress Attack Connected to Ransomware?

The WordPress vulnerabilities provide an initial route into an affected website. They are not ransomware and do not automatically encrypt files.

By chaining the flaws, an attacker may achieve remote code execution and run unauthorized commands within the compromised environment. The attacker could then deploy a separate payload to steal information, damage content, encrypt accessible files, or block the legitimate owner.

The Federal Bureau of Investigation defines ransomware as malware that prevents access to files, systems, or networks and demands payment for their return. A WordPress compromise becomes a ransomware incident only when an additional payload locks or encrypts data and issues a payment demand.

Not every extortion attempt uses encryption. Some attackers copy confidential information and threaten to publish it unless the victim pays. This is more accurately described as data-theft extortion.

A payment demand alone does not confirm whether:

• Files were encrypted
• Information was downloaded
• Backups were destroyed
• The sender controls a decryption key
• The recent WordPress vulnerabilities caused the breach

Those conclusions require technical evidence from files, databases, access logs, account activity, network records, and backups.

What Does the Ransomware.txt File Mean?

A file named Ransomware.txt or RansomNote.txt is a post-compromise ransom note. The text file does not exploit WordPress, execute the attack, or encrypt website data by itself.

An attacker or automated malware payload normally creates the note after obtaining unauthorized access. Its purpose is to deliver contact information, payment instructions, recovery claims, or threats to publish allegedly stolen data.

A possible technical sequence is:

1. A vulnerability or stolen credential provides initial access.
2. The attacker obtains higher privileges or creates a rogue administrator.
3. A malicious plugin, PHP web shell, or secondary payload establishes persistence.
4. Accessible files or database records are copied, modified, deleted, or encrypted.
5. A ransom-note file is written to the compromised website.
6. The victim receives a payment or extortion demand.

Finding a ransom-note file confirms that an unauthorized party or malicious process could write content to the environment. It does not independently identify the original entry point, prove that every listed dataset was stolen, or show that the attacker has a working decryption key.

The file should be preserved with its original name, location, contents, permissions, and timestamps. These details can help investigators connect it to other activity within the incident timeline.

Real Example of a WordPress Data-Extortion Email

From: J***** K**** <k********@gmail.com>
Date: July **, 2026
To: a***@********.com, m***@********.com, and other masked recipients
Subject: Data Breach Notification – ******** – Immediate Action Required

To the Management of ********,

This is a formal notification that your organization’s network has been compromised and sensitive data has been exfiltrated.

We claim to have accessed and downloaded information from your network, including:

• Customer records
• Employee information
• Financial documents
• Internal communications
• Website source code and configuration files
• Proprietary business data

This is not a ransomware attack. Your files have not been encrypted. We claim to possess a copy of your data.

Proof of access

We placed a file on your server:

https://********.com/RansomNote.txt

We also claim to have obtained records from the following WordPress database tables:

• wp_users: usernames and masked email addresses
• wp_posts: published content containing business references
• wp_********: submitted website forms and attachments
• wp_options: WordPress configuration entries

Extortion demand

You have ** hours to contact us. If you do not respond, we threaten to publish the allegedly stolen data and notify customers, business partners, competitors, or regulators.

Contact details, payment instructions, private messaging IDs, recovery identifiers, and attacker-controlled websites have been removed for safety.

— ********

What Does This Extortion Message Technically Prove?

The email describes data exfiltration followed by an extortion demand. The sender explicitly states that files were not encrypted, so the incident should not automatically be labeled file-encrypting ransomware.

The referenced RansomNote.txt file suggests that an unauthorized party obtained write access to the website. The database samples, if authentic and nonpublic, could indicate access to WordPress tables or a database export.

However, individual details in an extortion email can have several possible sources. Usernames may appear on public author pages. Employee information may be available on company websites. Old credentials may come from an earlier breach. A limited database sample does not prove that the attacker copied the complete network.

Investigators must independently determine:

• Whether the ransom-note file exists on the server
• When and which account created it
• Whether the database was queried or exported
• Whether outbound data transfers occurred
• Whether the samples contain private, current information
• Whether unauthorized administrators or web shells remain
• Whether the website shares credentials or storage with other systems
• Whether personal, financial, health, or regulated information was exposed

The original email should be preserved with its complete headers and attachments. Publishing the message publicly should only occur after masking personal information, private records, attacker contact IDs, recovery codes, and unsafe URLs.

What Should You Do Immediately After this WordPress Attack?

1. Update WordPress and preserve the evidence

Install the newest secured WordPress core release. Before making extensive changes, save available logs, suspicious files, account details, and ransom messages.

Create a controlled backup of the current state for investigation. Do not treat that copy as a clean recovery backup.

2. Find unauthorized access and malicious code

Review users, plugins, themes, uploads, database records, scheduled tasks, and hosting accounts.

Do not focus only on files detected by an automatic scanner. Attackers can use new code, modified legitimate files, database payloads, and hidden access methods that do not match a known malware signature.

3. Reset credentials and security salts

After removing malicious access, change all relevant credentials from a trusted device.

Reset:

• WordPress administrator passwords
• Hosting-account passwords
• FTP and SFTP credentials
• Database credentials
• SSH keys and passwords
• Connected email accounts
• API keys
• DNS and CDN access

Regenerate WordPress security salts to invalidate existing login sessions.

4. Inspect related websites

Websites sharing one hosting account may have access to overlapping directories or credentials. Examine every installation within the affected account instead of assuming the visible victim is the only compromised site.

5. Verify the cleanup before reopening

Test the website in a controlled environment. Confirm that unauthorized accounts are gone, clean files are in place, database content is valid, credentials have changed, and monitoring is active.

Reopening too early can expose visitors or allow a surviving backdoor to rebuild the infection.

Should You Pay a WordPress Ransom Demand?

The FBI does not support paying a ransom because payment does not guarantee that data will be recovered. Paying can also encourage further criminal activity. The agency recommends reporting ransomware incidents to law enforcement through its official reporting channels.

If a demand appears:

• Do not negotiate from a compromised email account.
• Preserve the note and payment address.
• Disconnect affected systems where practical.
• Protect untouched backups.
• Contact the hosting provider.
• Notify appropriate legal or insurance contacts.
• Report the incident.
• Seek professional incident-response assistance.

CISA’s StopRansomware Guide provides government guidance for preparing for and responding to ransomware incidents.

How Do You Restore WordPress Safely?

First, identify a recovery point that predates the initial unauthorized access. The date a redirect or ransom note appeared may be later than the original compromise.

A suitable backup should contain:

• Complete WordPress files
• A matching database
• Verified business content
• No unauthorized users
• No unexplained plugins
• No hidden executable files
• A documented creation date

Scan the backup outside the affected production environment. Update its WordPress core, plugins, and themes before making it publicly accessible.

Restore to a clean hosting environment when the original environment’s integrity cannot be established. Apply new passwords and keys rather than reusing credentials that may have been exposed.

How Is Malware Removed From a Hacked WordPress Website?

Effective removal requires three distinct stages.

Remove unauthorized access

Delete rogue users, malicious plugins, web shells, scheduled payloads, and unapproved hosting accounts. Revoke active sessions and access keys associated with the compromise.

Repair the website

Replace altered core files with verified copies. Review themes and plugins individually. Clean malicious database entries without deleting legitimate content.

Avoid deleting every unfamiliar file without analysis. Some websites contain custom code, integrations, or generated files that are necessary for normal operation.

Validate the result

Monitor file changes, login attempts, administrator creation, outbound connections, and visitor behavior after cleanup.

A site should not be considered clean merely because the visible warning has disappeared. Validation must confirm that the website remains stable and that the infection does not return.

See our complete WordPress malware removal guide for a broader cleanup workflow.

How Can You Protect WordPress From Future Attacks?

Keep WordPress core, plugins, and themes on supported versions. Remove extensions that are unused or no longer maintained.

Protect administrative access with:

• Unique passwords
• Multifactor authentication
• Limited administrator accounts
• Restricted plugin installation
• Disabled dashboard file editing
• Hosting login alerts
• Appropriate file permissions

Store backups away from the production account. Maintain more than one recovery point and test the restoration process periodically.

Monitor changes rather than waiting for a visitor or search engine to discover the infection. Early warnings should cover new administrators, modified files, unusual database activity, and unexpected traffic.

Need Professional WordPress Malware Cleanup?

WPHackedHelp is a specialized WordPress cleanup service provider that removes malware, repairs compromised websites, and helps prevent reinfection.

Our WordPress malware cleanup service includes:

• Removing malicious code and infected files
• Deleting unauthorized administrator accounts
• Detecting hidden PHP web shells and backdoors
• Cleaning infected themes, plugins, and uploads
• Repairing compromised WordPress core files
• Cleaning malicious database entries
• Removing redirects, phishing pages, and SEO spam
• Restoring recoverable website content
• Resetting compromised access points
• Hardening WordPress after cleanup

If your website is redirecting visitors, displaying security warnings, showing a ransom message, or repeatedly becoming infected, a basic malware scan may not be enough. WPHackedHelp performs a thorough cleanup to remove the visible infection and the hidden access responsible for bringing it back.

Request emergency WordPress malware cleanup from WPHackedHelp

Frequently Asked Questions About the Recent Server Attack

Does the WordPress attack affect WordPress.com and self-hosted websites?

Exposure depends on the WordPress version and hosting setup. Self-hosted owners should verify updates directly. WordPress.com and managed-hosting customers should ask their provider whether it patched and inspected the affected environment.

Can my hosting provider confirm whether hackers exploited my website?

A host can review access logs, file changes, account activity, and server snapshots for evidence of exploitation. Clean-looking logs do not guarantee safety if records were deleted, incomplete, or unavailable.

Is a WooCommerce store at greater risk after a WordPress takeover?

A compromised WooCommerce store may expose customer records, orders, payment settings, and API keys. Pause transactions, investigate data access, and rotate payment gateway keys and webhooks before reopening.

Will Google remove a malware warning after the website is cleaned?

Google may remove a warning after it confirms the threat is gone. Verify the cleanup, open the Security Issues report in Google Search Console, request a review, and avoid restoring infected pages or redirects.

Must a business notify customers after a WordPress data breach?

Notification depends on the information accessed and applicable privacy laws. Preserve evidence, determine whose data was exposed, consult qualified legal counsel, and notify affected users or regulators when required.

24/7 WP Security & Malware Removal

Is your site hacked or infected with malware? Let us get it fixed for you

Secure My Website(s)