Ninety minutes: watching attackers weaponize the WordPress core RCE
A critical unauthenticated chain in WordPress Core led to rapid exploitation within 90 minutes of the patch being released. Attackers used CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API route confusion) to create admin accounts and achieve remote code execution. Over 65,000 attempts were blocked by Patchstack from more than 1,500 unique IPs. The vulnerabilities affect versions 6.8 through 7.0.1 and are now fixed in 7.0.2, 6.9.5, and 6.8.6. Sites that remain unpatched should monitor for suspicious admin accounts, unknown plugins, or unexpected PHP files.
When we published our advisory on July 17, we ended it with the usual line: update immediately. We meant it, but we also knew what tends to happen next. A critical, unauthenticated, pre-auth chain in WordPress core is exactly the kind of bug that gets reverse-engineered from the patch and thrown at the entire internet within hours.…