BREAKING: A critical WordPress security crisis is actively being exploited, putting millions of websites at risk of full remote takeover by attackers even without a username or password.
The incident combines CVE-2026-63030, a REST API route-confusion flaw, with CVE-2026-60137, an SQL injection vulnerability capable of contributing to remote code execution.
On July 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency added both flaws to its Known Exploited Vulnerabilities Catalog, confirming active exploitation.
The complete attack chain affects WordPress 6.9 through 6.9.4 and WordPress 7.0 through 7.0.1, potentially exposing website databases, administrator accounts, plugins, server files, and visitor traffic.
WordPress 6.8 through 6.8.5 is also affected by CVE-2026-60137 (the SQL injection component) and should be updated to 6.8.6, though it is not vulnerable to the unauthenticated takeover chain described above. Updating to WordPress 6.8.6, 6.9.5, 7.0.2, or a later secured release closes the known vulnerabilities, but previously exposed websites must still be checked for rogue administrators, malicious plugins, PHP web shells, altered database records, and other persistent malware.
Table of Contents [TOC]
| Detail | Confirmed information |
| Target | WordPress core |
| Vulnerabilities | CVE-2026-63030 and CVE-2026-60137 |
| Public disclosure | July 17, 2026 |
| CISA exploitation listing | July 21, 2026 |
| Authentication required | No for the complete attack chain |
| User interaction required | No |
| Main risk | SQL injection and remote code execution |
| SQL-injection affected versions | WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1 |
| Complete attack-chain versions | WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 |
| Secured versions | WordPress 6.8.6, 6.9.5, and 7.0.2, depending on the installed branch |
| Immediate action | Update, preserve evidence, investigate, clean, and monitor |
The attack works by chaining two different weaknesses. Each flaw performs a separate role.
The first vulnerability, CVE-2026-63030 (CVSS 9.8), is an interpretation conflict involving the WordPress REST API batch endpoint, reported by Adam Kues.
In simple terms, different parts of WordPress can interpret the same request differently. That confusion may allow a request to reach a function it should not be allowed to access.
The second vulnerability, CVE-2026-60137 (CVSS 5.9), is an SQL injection flaw reported by TF1T, dtro, and haongo. SQL injection happens when unsafe input reaches a database query. An attacker may then change what the database is instructed to do.
The official NIST record for CVE-2026-63030 states that combining these flaws can lead to SQL injection and remote code execution.
Remote code execution means the attacker can make the website’s server run unauthorized commands. It is one of the most serious outcomes of a web application vulnerability because it moves the incident beyond content editing or information exposure.
Once code execution is available, the hacker can install a persistent method of access. Removing the original entry point will not automatically remove that persistence.
This incident affects WordPress core rather than one optional plugin.
A website does not need an abandoned theme or obscure extension to be exposed to the complete vulnerability chain. A standard WordPress installation running an affected core version may be at risk.
The attack is also remotely accessible. The vulnerability records indicate that no existing privileges or user interaction are required. A visitor does not need to open a malicious attachment, and an administrator does not need to approve a login.
Automated exploitation makes the threat more urgent. A malicious program can scan large numbers of public websites, identify likely WordPress installations, and send prepared requests without manually selecting each business.
The potential technical impact is extensive. Attackers who obtain code execution may gain control over website files, database access, and normal WordPress functions. The exact damage will depend on hosting permissions and the actions performed after entry.
Yes. CISA lists both vulnerabilities in its Known Exploited Vulnerabilities Catalog.
Inclusion in that catalog means there is evidence that attackers have exploited the vulnerabilities in real environments. It does not mean every website running an affected version has been hacked.
Small websites should still act quickly. Automated attacks generally search for technical exposure. They do not care whether a site belongs to a multinational business, a local store, an independent professional, or a personal publisher.
A less prominent site can still be useful to criminals. A compromised WordPress installation can host scam pages, redirect visitors, distribute malware, manipulate search results, or become part of a wider attack operation.
The WordPress vulnerabilities provide an initial route into an affected website. They are not ransomware and do not automatically encrypt files.
By chaining the flaws, an attacker may achieve remote code execution and run unauthorized commands within the compromised environment. The attacker could then deploy a separate payload to steal information, damage content, encrypt accessible files, or block the legitimate owner.
The Federal Bureau of Investigation defines ransomware as malware that prevents access to files, systems, or networks and demands payment for their return. A WordPress compromise becomes a ransomware incident only when an additional payload locks or encrypts data and issues a payment demand.
Not every extortion attempt uses encryption. Some attackers copy confidential information and threaten to publish it unless the victim pays. This is more accurately described as data-theft extortion.
A payment demand alone does not confirm whether:
Those conclusions require technical evidence from files, databases, access logs, account activity, network records, and backups.
A file named Ransomware.txt or RansomNote.txt is a post-compromise ransom note. The text file does not exploit WordPress, execute the attack, or encrypt website data by itself.
An attacker or automated malware payload normally creates the note after obtaining unauthorized access. Its purpose is to deliver contact information, payment instructions, recovery claims, or threats to publish allegedly stolen data.
A possible technical sequence is:
Finding a ransom-note file confirms that an unauthorized party or malicious process could write content to the environment. It does not independently identify the original entry point, prove that every listed dataset was stolen, or show that the attacker has a working decryption key.
The file should be preserved with its original name, location, contents, permissions, and timestamps. These details can help investigators connect it to other activity within the incident timeline.
From: J***** K**** <k********@gmail.com>
Date: July **, 2026
To: a***@********.com, m***@********.com, and other masked recipients
Subject: Data Breach Notification – ******** – Immediate Action Required
To the Management of ********,
This is a formal notification that your organization’s network has been compromised and sensitive data has been exfiltrated.
We claim to have accessed and downloaded information from your network, including:
This is not a ransomware attack. Your files have not been encrypted. We claim to possess a copy of your data.
Proof of access
We placed a file on your server:
https://********.com/RansomNote.txt
We also claim to have obtained records from the following WordPress database tables:
Extortion demand
You have ** hours to contact us. If you do not respond, we threaten to publish the allegedly stolen data and notify customers, business partners, competitors, or regulators.
Contact details, payment instructions, private messaging IDs, recovery identifiers, and attacker-controlled websites have been removed for safety.
— ********
The email describes data exfiltration followed by an extortion demand. The sender explicitly states that files were not encrypted, so the incident should not automatically be labeled file-encrypting ransomware.
The referenced RansomNote.txt file suggests that an unauthorized party obtained write access to the website. The database samples, if authentic and nonpublic, could indicate access to WordPress tables or a database export.
However, individual details in an extortion email can have several possible sources. Usernames may appear on public author pages. Employee information may be available on company websites. Old credentials may come from an earlier breach. A limited database sample does not prove that the attacker copied the complete network.
Investigators must independently determine:
The original email should be preserved with its complete headers and attachments. Publishing the message publicly should only occur after masking personal information, private records, attacker contact IDs, recovery codes, and unsafe URLs.
Install the newest secured WordPress core release. Before making extensive changes, save available logs, suspicious files, account details, and ransom messages.
Create a controlled backup of the current state for investigation. Do not treat that copy as a clean recovery backup.
Review users, plugins, themes, uploads, database records, scheduled tasks, and hosting accounts.
Do not focus only on files detected by an automatic scanner. Attackers can use new code, modified legitimate files, database payloads, and hidden access methods that do not match a known malware signature.
After removing malicious access, change all relevant credentials from a trusted device.
Reset:
Regenerate WordPress security salts to invalidate existing login sessions.
Websites sharing one hosting account may have access to overlapping directories or credentials. Examine every installation within the affected account instead of assuming the visible victim is the only compromised site.
Test the website in a controlled environment. Confirm that unauthorized accounts are gone, clean files are in place, database content is valid, credentials have changed, and monitoring is active.
Reopening too early can expose visitors or allow a surviving backdoor to rebuild the infection.
The FBI does not support paying a ransom because payment does not guarantee that data will be recovered. Paying can also encourage further criminal activity. The agency recommends reporting ransomware incidents to law enforcement through its official reporting channels.
If a demand appears:
CISA’s StopRansomware Guide provides government guidance for preparing for and responding to ransomware incidents.
First, identify a recovery point that predates the initial unauthorized access. The date a redirect or ransom note appeared may be later than the original compromise.
A suitable backup should contain:
Scan the backup outside the affected production environment. Update its WordPress core, plugins, and themes before making it publicly accessible.
Restore to a clean hosting environment when the original environment’s integrity cannot be established. Apply new passwords and keys rather than reusing credentials that may have been exposed.
Effective removal requires three distinct stages.
Delete rogue users, malicious plugins, web shells, scheduled payloads, and unapproved hosting accounts. Revoke active sessions and access keys associated with the compromise.
Replace altered core files with verified copies. Review themes and plugins individually. Clean malicious database entries without deleting legitimate content.
Avoid deleting every unfamiliar file without analysis. Some websites contain custom code, integrations, or generated files that are necessary for normal operation.
Monitor file changes, login attempts, administrator creation, outbound connections, and visitor behavior after cleanup.
A site should not be considered clean merely because the visible warning has disappeared. Validation must confirm that the website remains stable and that the infection does not return.
See our complete WordPress malware removal guide for a broader cleanup workflow.
Keep WordPress core, plugins, and themes on supported versions. Remove extensions that are unused or no longer maintained.
Protect administrative access with:
Store backups away from the production account. Maintain more than one recovery point and test the restoration process periodically.
Monitor changes rather than waiting for a visitor or search engine to discover the infection. Early warnings should cover new administrators, modified files, unusual database activity, and unexpected traffic.
WPHackedHelp is a specialized WordPress cleanup service provider that removes malware, repairs compromised websites, and helps prevent reinfection.
Our WordPress malware cleanup service includes:
If your website is redirecting visitors, displaying security warnings, showing a ransom message, or repeatedly becoming infected, a basic malware scan may not be enough. WPHackedHelp performs a thorough cleanup to remove the visible infection and the hidden access responsible for bringing it back.
Request emergency WordPress malware cleanup from WPHackedHelp
Exposure depends on the WordPress version and hosting setup. Self-hosted owners should verify updates directly. WordPress.com and managed-hosting customers should ask their provider whether it patched and inspected the affected environment.
A host can review access logs, file changes, account activity, and server snapshots for evidence of exploitation. Clean-looking logs do not guarantee safety if records were deleted, incomplete, or unavailable.
A compromised WooCommerce store may expose customer records, orders, payment settings, and API keys. Pause transactions, investigate data access, and rotate payment gateway keys and webhooks before reopening.
Google may remove a warning after it confirms the threat is gone. Verify the cleanup, open the Security Issues report in Google Search Console, request a review, and avoid restoring infected pages or redirects.
Notification depends on the information accessed and applicable privacy laws. Preserve evidence, determine whose data was exposed, consult qualified legal counsel, and notify affected users or regulators when required.