Security Bulletin — July 19, 2026: wp2shell — Public Exploits Are Out and the First Attacks Have Begun (CVE-2026-60137 & CVE-2026-63030)

This is our daily security overview, in which we review the published vulnerabilities and highlight those that are actually relevant for the operation of WordPress websites, online shops, and PHP applications. Every statement has been verified against the underlying primary source and linked at the end of the respective section. July 19 falls on a weekend and produced no new standalone vulnerability in this category; there was no new Shopware advisory and no new PHP core flaw on this day. What continues to dominate is a single, rapidly escalating event: the core attack chain “wp2shell” — a SQL injection (CVE-2026-60137) combined with a route confusion in the REST batch endpoint (CVE-2026-63030), disclosed on July 17 and described in detail in yesterday’s edition — has, over the weekend, turned from a theoretical warning into an active attack. Because the situation has grown markedly more dangerous, we deliberately devote this edition to the follow-up state, and to the question of what operators should do if they did not already update on Friday or Saturday.

The Warning Has Become an Active Attack

At the time of the initial disclosure on July 17, the precise mechanics of the chain were withheld to give operators time to apply the update. That grace period is over: over the weekend, several working attack tools surfaced on public code platforms that reproduce the full path from an unauthenticated request through to remote code execution on a default installation. Exploitation is therefore no longer confined to specialist researchers but is open to anyone. The security vendor Patchstack reports having seen the first exploitation attempts against CVE-2026-63030 in its own telemetry as early as the evening of July 17; the team at watchTowr likewise reports the first signs of exploitation in the wild. Reliable case numbers are not yet available, and as of the weekend the chain had not been added to the KEV catalog maintained by the U.S. agency CISA — but for a risk assessment that changes nothing: once working exploit code is freely available and the target population comprises practically every unpatched WordPress installation, every operator should assume active, broadly distributed attacks.

Sources: BleepingComputer — WordPress Core “wp2shell” RCE flaws get public exploits · Patchstack — Unauthenticated SQL Injection in WordPress Core Fixed in 7.0.2

If You Did Not Update Over the Weekend, Assume Compromise

The WordPress security team triggered forced background updates for affected installations, so most sites should already read 7.0.2, 6.9.5, or 6.8.6. Do not rely on that alone: check the installed core version under “Updates” in the dashboard, and apply the update by hand without delay wherever automatic core updates have been disabled. The decisive difference from yesterday’s situation, however, is this: if a site was online and unpatched over the weekend, simply installing the new version is no longer enough, because a successful attack could already have taken place. Since the SQL injection allows arbitrary database contents to be read — including the password hashes of administrators, which can be cracked offline — and the full chain reaches as far as dropping a web shell, additional steps are warranted in that case: review the user list for unrecognized administrator accounts, scan the uploads directory and the web root for unexpected or recently modified PHP files, and search the access logs for requests to /wp-json/batch/v1 or the ?rest_route=/batch/v1 parameter. When in doubt, rotate the administrator passwords and the secret keys in wp-config.php, and consider restoring from a backup taken before July 17. As a supporting measure, the batch endpoint can be blocked for anonymous requests through an access rule or a web application firewall until a verified cleanup is complete; Cloudflare has rolled out a corresponding rule for the affected versions across all of its plans. Whether an installation is vulnerable at all can also be determined using the checker provided by the discovering team, Searchlight Cyber, at wp2shell.com.

Sources: WordPress 7.0.2 Security Release · The Hacker News — New wp2shell WordPress Core Flaw

Unsure whether you are affected? Get in touch.

---

This notice serves security-awareness purposes. The official advisories of the respective vendor and the primary sources linked above are always authoritative.