On July 17th, 2026, the WordPress Security Team released updates to WordPress core addressing a critical vulnerability chain that can be leveraged by unauthenticated attackers to create an administrator account and then execute code through normal administrator capabilities, such as uploading a plugin. The chain consists of two vulnerabilities: an unauthenticated SQL injection vulnerability identified as CVE-2026-60137 , and a REST API batch request route confusion vulnerability identified as CVE-2026-63030 , which can be chained with the SQL injection to escalate the impact to unauthenticated administrator account creation. The primary SQL Injection vulnerability affects WordPress core versions 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1, while the batch confusion vulnerability only affects the latter two ranges. The Wordfence Firewall has already blocked over 11 million exploit attempts targeting this vulnerability. Our attack data currently reflects only Wordfence customers protected by the premium firewall rule, a small percentage of our user base, underscoring the sheer volume of attacks targeting this vulnerability. Fortunately, the vulnerability affected relatively few major WordPress versions, and the Security Team issued forced automatic updates. As a result, we expect the larger majority of sites are likely no longer vulnerable, and the high attack volume does not necessarily indicate a rise in successful compromises. Regardless, this still highlights the importance of verifying your site is updated sooner rather than later so that it does not become compromised. Wordfence Premium , Wordfence Care , and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on July 17, 2026, the day of disclosure. Sites using the free version of Wordfence will receive the same protection 30 days later on August 16, 2026. Considering this vulnerability is being actively exploited, we urge users to ensure their sites are updated to a patched version of WordPress core as soon as possible. WordPress sites with automatic background updates enabled should already have been updated to the patched version. Vulnerability Summary from Wordfence Intelligence WordPress Core 6.8 - 7.0.1 - Unauthenticated SQL Injection via author__not_in Parameter 7.5 CVSS Rating 7.5 (High) CVE-ID CVE-2026-60137 Affected Version(s) Various Patched Versions 6.8.6, 6.9.5, 7.0.2 Affected Software WordPress [wordpress] Researchers Tin Pham (TF1T) Trong Pham (dtro) haongo WordPress Core is vulnerable to generic SQL Injection via the 'author__not_in' parameter in versions 6.8 - 7.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. More Details > WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion 9.8 CVSS Rating 9.8 (Critical) CVE-ID CVE-2026-63030 Affected Version(s) Various Patched Versions 6.9.5, 7.0.2 Affected Software WordPress [wordpress] Researcher Adam Kues WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route's input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server. More Details > Vulnerability Details The security researcher Adam Kues who discovered the vulnerability chain published a detailed write-up of the discovery and exploitation process, which can be found at the following link: https://slcyber.io/research-center/exploit-brokers-pay-500000-for-a-wordpress-rce-i-found-one-with-gpt5-6/ As with any Administrator User Creation vulnerability, this vulnerability can be used for a complete site compromise. Once an attacker has gained administrative user access to a WordPress site, they can then manipulate anything on the targeted site as a normal administrator would. This includes the ability to upload plugin and theme files, which can be malicious zip files containing backdoors. A Closer Look at the Attack Data The following data highlights actual exploit attempts from threat actors targeting this vulnerability. In the attacks we have observed, threat actors are chaining the vulnerabilities to create a new administrator account on the affected site. POST /?rest_route=/batch/v1 HTTP/1.1 Host: [redacted] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Content-Type: application/json { "requests": [ { "method": "POST", "path": "http://" }, { "body": { "requests": [ { "method": "GET", "path": "http://" }, { "method": "GET", "path": "/wp/v2/widgets?author_exclude=*<sqli_payload>*" }, { "method": "GET", "path": "/wp/v2/posts" }, { "body": { "email": "wpenginebot@wpengine.com", "password": "[redacted]", "roles": [ "administrator" ], "username": "wpenginebot" }, "method": "POST", "path": "/wp/v2/users" }, { "body": { "email": "wpenginebot@wpengine.com", "password": "[redacted]", "roles": [ "administrator" ], "username": "wpenginebot" }, "method": "POST", "path": "/wp/v2/users" } ] }, "method": "POST", "path": "/wp/v2/posts" }, { "body": { "requests": [] }, "method": "POST", "path": "/batch/v1" } ] } Wordfence Firewall The following graphic demonstrates the steps to exploitation an attacker might take and at which point the Wordfence firewall would block an attacker from successfully exploiting the vulnerability. Total Number of Exploits Blocked The Wordfence Firewall has blocked over 11 million exploit attempts targeting this vulnerability. According to our data, attackers began targeting websites on July 17th, 2026, the day the vulnerability was disclosed, with only a small number of probing attempts on that first day. We also detected and blocked a large number of exploit attempts from July 18th, 2026. Top Offending IP Addresses The following IP Addresses are currently the most actively engaged IP addresses targeting this vulnerability: 103.215.74.26 Over 741,000 blocked requests. 103.215.75.66 Over 730,000 blocked requests. 103.215.75.19 Over 640,000 blocked requests. 103.168.67.253 Over 541,000 blocked requests. 51.195.39.149 Over 344,000 blocked requests. 103.168.66.101 Over 340,000 blocked requests. 51.195.39.150 Over 253,000 blocked requests. 140.174.186.101 Over 236,000 blocked requests. 45.148.10.18 Over 123,000 blocked requests. 45.148.10.247 Over 121,000 blocked requests. Indicators of Compromise The attackers are attempting to create new administrator accounts on affected sites. It is recommended to review the list of WordPress users on your site and remove any unknown administrator accounts, especially ones created on or after July 17th, 2026. But if the attackers manage to log in as an administrator, they can easily clear their tracks. We also recommend reviewing log files for any requests to the /wp-json/batch/v1 endpoint, particularly those originating from the following IP addresses: 103.215.74.26 103.215.75.66 103.215.75.19 103.168.67.253 51.195.39.149 103.168.66.101 51.195.39.150 140.174.186.101 45.148.10.18 45.148.10.247 The absence of any such log entries does not guarantee that your website has not been compromised. A High Volume of Attacks Does Not Necessarily Mean More Compromises While this post highlights the significant volume of attack activity our team has observed, it’s important to distinguish attempted attacks from successful compromises. Our Care and Response team has been closely monitoring the situation. When a serious vulnerability affects a large number of websites, we typically see a corresponding increase in compromised sites and support requests. In this case, however, we have not observed such a surge. This is an encouraging sign. One of the most critical WordPress core vulnerabilities identified in the past decade did not result in a catastrophic situation. Several factors likely contributed to this outcome like how the vulnerability was discovered through AI-assisted research only two core releases after it was introduced and how the WordPress Security Team responded exceptionally well. The team coordinated WAF rules with hosting providers and forced the security update to be pushed to sites wherever possible. This overall demonstrated the strength of the broader WordPress security ecosystem. The response also reflects the maturity WordPress core has reached and the increasingly strong security practices surrounding it. As AI-assisted security research continues to advance and gain adoption, we expect these capabilities, and the resilience of the WordPress ecosystem, to improve even further. Conclusion In today’s article, we covered the attack data for a critical-severity vulnerability chain in WordPress core, affecting versions 6.8 through 6.8.5, 6.9 through 6.9.4, and 7.0 through 7.0.1, that allows unauthenticated threat actors to create an administrator account and then execute arbitrary code and achieve complete site compromise. This is the first critical unauthenticated remote code execution vulnerability in WordPress core in nearly a decade. Our threat intelligence indicates that attackers began targeting this vulnerability the same day it was disclosed, on July 17th, 2026, with mass exploitation occurring from July 18th, 2026. The Wordfence firewall has already blocked over 11 million exploit attempts targeting this vulnerability. Wordfence Premium , Wordfence Care , and Wordfence Response users received a firewall rule to protect against any exploits targeting this vulnerability on July 17, 2026. Sites using the free version of Wordfence will receive the same protection 30 days later on August 16, 2026. We strongly urge all WordPress users to ensure their sites are running a patched version of WordPress core. If you have friends or colleagues running WordPress sites, be sure to forward this advisory to them, as millions of sites could still be unprotected and unpatched. If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care . If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance. The post WP2Shell WordPress Exploit Technical Analysis and Real Attack Data appeared first on Wordfence .