Critical WordPress Security Vulnerabilities Exploited

Attackers are currently exploiting two critical security vulnerabilities in WordPress, known as CVE-2026-63030 and CVE-2026-60137. These vulnerabilities enable unauthenticated remote code execution (RCE) through the combination of both flaws. Attacks began in the early hours of July 22, 2026 (UTC), with numerous successful exploitations already reported. The vulnerability CVE-2026-63030 affects a flaw in the WordPress core, allowing attackers to inject malicious code into the website.

This vulnerability is particularly dangerous as it can be exploited without authentication, meaning attackers do not need special permissions to gain control over the affected systems. Additionally, the vulnerability CVE-2026-60137 is seen as a catalyst for the exploitation of CVE-2026-63030. This second vulnerability amplifies the impact of the first by making it easier for attackers to take control of the website. The combination of these two vulnerabilities has led to an increase in automated scans and attacks on WordPress websites. The security community has already warned about the risks associated with these vulnerabilities.

Experts advise website operators to update their systems immediately and implement security measures to protect against potential attacks. WordPress developers are working on a patch to address the vulnerabilities and ensure the platform's security. The spread of the attacks has prompted many hosting providers to inform their customers about the risks and urge them to check their WordPress installations. Some providers have even taken proactive measures to prevent potential attacks by monitoring suspicious activities on their servers. The impact of these vulnerabilities is significant, as WordPress is one of the most widely used content management systems worldwide.

It is estimated that over 40% of all websites run on WordPress, driving the potential number of affected systems into the millions. The vulnerabilities could not only jeopardize the integrity of the affected websites but also the data of millions of users. The vulnerabilities have been identified by various security researchers who discovered the flaws during their investigations. The discovery of these vulnerabilities has drawn the security community's attention to the need for continuous monitoring and improvement of security practices in WordPress development. The WordPress community has already responded to the threat by providing resources and information to help website operators secure their systems.

Forums and social media are filled with discussions about best practices for securing WordPress installations and avoiding attacks. The vulnerabilities CVE-2026-63030 and CVE-2026-60137 are another example of the challenges faced by developers of content management systems. The constant evolution of technologies and the increasing complexity of web applications require a proactive approach to security. The release of a patch to address these vulnerabilities is eagerly anticipated by many in the community. Developers have announced that they will provide a solution in the coming days to ensure the security of the WordPress platform.

However, a specific date for the release of the update is still pending. The vulnerabilities have already been documented in several reports, and the CVE numbers are listed in the National Vulnerability Database (NVD). The NVD provides comprehensive information about the vulnerabilities and their impact on the security of web applications. The current situation underscores the necessity of regularly performing security updates and keeping systems up to date. According to a survey among WordPress users, 65% reported that they do not regularly update their installations, making them vulnerable to attacks.