Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: wordpress

CVE-2026-119977: WordPress Core RCE via TOCTOU Race Condition

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-119977 is a high-severity Time-of-Check Time-of-Use (TOCTOU) race condition vulnerability affecting WordPress Core. It allows unauthenticated attackers to execute arbitrary code on the server. This threat is particularly critical as it leverages the legitimate core upgrade process, making affected WordPress installations vulnerable during their update windows.

Technical Analysis

WordPress Core versions 4.7 through 7.1.3 are vulnerable to Remote Code Execution (RCE) due to a TOCTOU race condition (CWE-367). The vulnerability arises from the use of predictable, web-accessible staging paths during full-package core upgrades. An unauthenticated attacker can exploit this window by racing the legitimate upgrade process, likely by injecting malicious code into these temporary staging paths before they are fully processed or used by the system. The CVSS 3.1 score for this vulnerability is 8.1 (High), with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

  • Affected Versions: WordPress Core versions 4.7 through 7.1.3.
  • Attack Vector: Unauthenticated network access (AV:N).
  • Prerequisites: The target WordPress instance must be undergoing a full-package core upgrade.
  • Exploitation: Attackers exploit a race condition during the upgrade process, leveraging predictable, web-accessible staging paths to introduce malicious code.

Detection

Detecting exploitation of CVE-2026-119977 primarily involves monitoring for anomalous activity during or immediately after WordPress core upgrades.

  • Web Server Logs: Monitor for unusual or unexpected requests to wp-admin or temporary upgrade directories (e.g., wp-content/upgrade/) that do not align with legitimate upgrade traffic patterns.
  • Process Monitoring: Look for the web server process (e.g., httpd, nginx, php-fpm, w3wp.exe) spawning unusual child processes such as cmd.exe, powershell.exe, sh, bash, python, or perl outside of expected administrative tasks.
  • File Integrity Monitoring (FIM): Monitor for unexpected file creations or modifications in WordPress core directories (wp-admin, wp-includes, wp-content) during or immediately following an upgrade, especially for executable file types (.php, .pl, .py, .sh).
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual external IP addresses or domains, which could indicate a successful webshell or backdoor.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

Web Server Process Spawning Suspicious Child Process (Windows)

title: Web Server Process Spawning Suspicious Child Process (Windows)
id: 5f9e2d1c-8b7a-4c3e-9e7f-0d2a1b3c4e5f
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Windows.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith:
      - '\\w3wp.exe'
      - '\\httpd.exe'
      - '\\nginx.exe'
      - '\\php-cgi.exe'
    Image|endswith:
      - '\\cmd.exe'
      - '\\powershell.exe'
      - '\\pwsh.exe'
      - '\\cscript.exe'
      - '\\wscript.exe'
  condition: selection
level: high

Web Server Process Spawning Suspicious Child Process (Linux)

title: Web Server Process Spawning Suspicious Child Process (Linux)
id: 6a7b8c9d-0e1f-2a3b-4c5d-6e7f8a9b0c1d
status: experimental
description: Detects a web server process spawning suspicious child processes, indicative of successful RCE exploitation on Linux.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: 'EXECVE'
    process.parent.name:
      - 'apache2'
      - 'httpd'
      - 'nginx'
      - 'php-fpm'
    process.name:
      - 'sh'
      - 'bash'
      - 'python'
      - 'perl'
      - 'php'
      - 'nc'
      - 'ncat'
      - 'wget'
      - 'curl'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade all WordPress installations to version 7.1.4 or later. This is the most critical mitigation.
  2. Restrict Access During Upgrades: If possible, temporarily restrict network access to the wp-admin directory or the entire WordPress site during core upgrade windows to minimize the attack surface.
  3. Implement Strong File Permissions: Ensure strict file permissions are enforced on WordPress directories, especially wp-content and wp-admin, to prevent unauthorized file writes.
  4. Deploy a Web Application Firewall (WAF): A WAF can help detect and block suspicious requests targeting WordPress upgrade paths or common webshell patterns.
  5. Regular Backups: Maintain regular, tested backups of your WordPress site and database to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-119977
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-core-upgrader.php#L162
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/class-wp-upgrader.php#L378
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/includes/update-core.php#L1549
  • https://core.trac.wordpress.org/browser/tags/7.1.3/src/wp-admin/setup-config.php#L282
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/class-wp-upgrader.php#L346
  • https://core.trac.wordpress.org/browser/tags/7.1.4/src/wp-admin/includes/update-core.php#L1545
  • https://wordpress.org/news/2026/10/wordpress-7-1-4/
  • https://www.wordfence.com/threat-intel/vulnerabilities/id/4b4da0cf-d9f4-47c4-a0e8-6c4dc5a6f250?source=cve
  • https://ltna.com.au/cyber

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1059 — Command and Scripting Interpreter
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,187 input / 1,937 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged cwe-367, high, rce, vulnerability, web, wordpressLeave a comment

Ninja Forms Plugin Flaw Exploited to Hack WordPress Sites

Posted on October 6, 2026 by Kyle

Overview

A stored Cross-Site Scripting (XSS) vulnerability within the Ninja Forms WordPress plugin is currently under active exploitation. Threat actors are leveraging this flaw to compromise WordPress websites, primarily by installing backdoors and establishing rogue administrative user accounts. This poses a critical risk to the integrity and security of affected web properties.

Technical Analysis

The vulnerability is identified as a stored Cross-Site Scripting (XSS) flaw in the Ninja Forms plugin. This type of vulnerability allows attackers to inject malicious scripts into web applications, which are then stored on the server and executed when a user (often an administrator) views the compromised content. In this exploitation, the XSS payload facilitates:

  • Backdoor Installation: Malicious files are uploaded or created on the server, providing persistent access to the compromised WordPress environment.
  • Rogue Admin Account Creation: Unauthorized user accounts with administrative privileges are created, granting attackers full control over the WordPress site.

The specific affected versions of the Ninja Forms plugin are not detailed in the source material, but active exploitation indicates that unpatched installations are vulnerable. The attack vector typically involves submitting crafted input through a form managed by Ninja Forms, where the input is not properly sanitized before being stored and subsequently displayed.

Detection

Defenders can identify potential exploitation through the following methods:

  • Web Server Access Logs: Monitor for unusual POST requests to WordPress admin endpoints (/wp-admin/, /wp-json/, /wp-content/plugins/ninja-forms/) containing script tags (<script>), javascript: URIs, or common XSS event handlers (onerror=, onload=).
  • File Integrity Monitoring (FIM): Look for newly created or modified .php files in sensitive WordPress directories such as wp-content/uploads/, wp-content/plugins/, or wp-includes/, especially if created by the web server process.
  • WordPress Database Auditing: Review wp_users and wp_options tables for new, unauthorized administrative user accounts or suspicious entries indicative of backdoor code.
  • User Activity Logs: Monitor for the creation of new user accounts with administrator privileges, particularly if not initiated by a legitimate administrator.
  • WAF Logs: Analyze Web Application Firewall logs for blocked XSS attempts targeting WordPress form submission endpoints.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress Backdoor File Creation (Sysmon)

title: WordPress Backdoor File Creation (Sysmon)
id: e6d5f4c3-b2a1-4d0e-8c7f-6a5b4d3c2b1a
status: experimental
description: Detects suspicious file creation in common WordPress directories, potentially indicating a backdoor upload via a compromised web server process.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-content\plugins\'
      - '\wp-includes\'
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.asp'
      - '.aspx'
    Image|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
  condition: selection
level: high

WordPress Rogue Admin Account Creation (Web Server Logs)

title: WordPress Rogue Admin Account Creation (Web Server Logs)
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects attempts to create new administrative user accounts in WordPress via web server access logs, which could indicate post-exploitation activity.
logsource:
  product: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/wp-admin/user-new.php'
    cs-uri-query|contains: 'role=administrator'
  condition: selection
level: high

Mitigations

Prioritize the following actions to mitigate the risk and impact of this vulnerability:

  1. Update Ninja Forms Plugin: Immediately update the Ninja Forms plugin to the latest available version. Consult the official plugin repository or vendor for patch availability.
  2. Review User Accounts: Audit all WordPress user accounts for unauthorized administrators or suspicious new users. Remove any accounts that cannot be legitimate.
  3. Scan for Backdoors: Perform a comprehensive scan of the WordPress installation using reputable security plugins or tools to identify and remove any installed backdoors or malicious files.
  4. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block XSS attempts and other common web exploits.
  5. Regular Backups: Ensure regular, verified backups of your WordPress site and database are maintained to facilitate recovery in case of compromise.

References

  • https://www.bleepingcomputer.com/news/security/ninja-forms-plugin-flaw-exploited-to-hack-wordpress-sites/

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1136.001 — Local Account
  • T1505.003 — Web Shell
  • T1059.004 — Unix Shell
🤖 AI Attribution
Generated by gemini-2.5-flash ·
1,494 input / 1,410 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged backdoor, critical, plugin, vulnerability, web-application, wordpress, xssLeave a comment

WordPress Core SQL Injection (CVE-2026-60137) Chained for RCE

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-60137 is a SQL injection vulnerability affecting WordPress Core. While rated Medium severity on its own, it is critical because it can be chained with CVE-2026-63030 to enable unauthenticated remote code execution (RCE). This vulnerability is actively exploited, making immediate patching crucial for all WordPress administrators.

Technical Analysis

The vulnerability resides in the WP_Query component of WordPress Core, specifically in how it handles the author__not_in parameter. WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize untrusted input passed to this parameter by a plugin or theme. This allows an attacker to inject arbitrary SQL queries.

  • Vulnerability Type: SQL Injection (CWE-89)
  • Affected Versions:
    • WordPress >= 6.8, < 6.8.6
    • WordPress >= 6.9, < 6.9.5
    • WordPress >= 7.0, < 7.0.2
  • Prerequisites: A plugin or theme must pass untrusted input to the author__not_in parameter of WP_Query.
  • Attack Vector: Network (CVSS:3.1/AV:N)
  • Impact: High confidentiality impact (CVSS:3.1/C:H), no integrity or availability impact on its own. When chained with CVE-2026-63030, it leads to RCE.
  • CVSS 3.1 Score: 5.9 (MEDIUM)

Detection

  • Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests containing author__not_in= in the URI or POST body, especially when combined with common SQL injection payloads such as UNION SELECT, ' OR 1=1--, SLEEP(), or LOAD_FILE(). Look for unusual HTTP status codes or response sizes following such requests.
  • Process Monitoring: On web servers, monitor for the web server process (e.g., httpd.exe, nginx.exe, php-fpm.exe, w3wp.exe) spawning unusual child processes, particularly command shells (cmd.exe, powershell.exe, sh, bash) or scripting interpreters, which could indicate successful RCE.
  • File Integrity Monitoring (FIM): Implement FIM on WordPress installation directories. Alert on the creation or modification of new .php files in web-accessible directories (wp-content, wp-includes, plugin/theme directories), as this could indicate a webshell drop.
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual or known malicious IP addresses/domains, which might indicate command-and-control (C2) communication or data exfiltration post-exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress Core SQL Injection CVE-2026-60137 Attempt

title: WordPress Core SQL Injection CVE-2026-60137 Attempt
id: 9029a1b8-20d0-482a-97a6-407133f93282
status: experimental
description: Detects attempts to exploit CVE-2026-60137, a SQL injection vulnerability in WordPress Core's WP_Query author__not_in parameter.
logsource:
  category: webserver
detection:
  selection_uri:
    - cs-uri-query|contains: 'author__not_in='
    - c-uri|contains: 'author__not_in='
  selection_sqli_patterns:
    - cs-uri-query|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
    - c-uri|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
  condition: selection_uri and selection_sqli_patterns
level: high

Web Server Process Spawning Suspicious Shell (Windows)

title: Web Server Process Spawning Suspicious Shell (Windows)
id: 4b27f67d-93d3-4a11-a81d-66f688820c7a
status: experimental
description: Detects a web server process spawning a command shell, indicative of successful remote code execution, potentially via CVE-2026-60137 chaining.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
level: critical

Web Server Process Creating Suspicious PHP File (Windows)

title: Web Server Process Creating Suspicious PHP File (Windows)
id: 7e7f8e1a-5b0c-4d3e-8f9a-2c1d0e6f7b8c
status: experimental
description: Detects a web server process creating a new PHP file in a web-accessible directory, which could indicate a webshell drop after successful exploitation.
logsource:
  product: windows
  service: sysmon
  definition: 'Requires Sysmon EventID 11 (FileCreate) to be enabled.'
detection:
  selection_process:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_file:
    TargetFilename|endswith: '.php'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-content\plugins\'
      - '\wp-content\themes\'
      - '\html\'
      - '\www\'
  condition: selection_process and selection_file
level: high

Mitigations

  1. Patch Immediately: Update all affected WordPress installations to the latest patched versions: 6.8.6, 6.9.5, 7.0.2, or newer. This is the most critical step to prevent exploitation.
  2. Web Application Firewall (WAF): Deploy and configure a WAF to detect and block common SQL injection patterns, specifically targeting the author__not_in parameter in WordPress requests. Ensure rules are updated to cover known exploitation patterns for this CVE.
  3. Review Plugins and Themes: Audit all third-party and custom WordPress plugins and themes. Prioritize those that interact with WP_Query or user-supplied input for author__not_in to ensure proper input sanitization and validation are in place.
  4. Principle of Least Privilege: Ensure the web server process and its associated PHP processes run with the minimum necessary privileges to limit the impact of successful exploitation.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-60137
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,343 input / 2,291 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged actively exploited, cve-2026-60137, cve-2026-63030, medium, pre-authentication, rce, sql injection, vulnerability, webshell, wordpressLeave a comment

CVE-2026-63030: WordPress REST API RCE via Chained SQL Injection

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-63030 is a critical vulnerability affecting WordPress Core, specifically its REST API batch endpoint. This flaw, when combined with a separate SQL Injection vulnerability (CVE-2026-60137), enables unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations. Given its CVSS score of 9.8 and confirmed active exploitation, immediate patching is essential for all affected WordPress sites.

Technical Analysis

  • Vulnerability Type: Interpretation Conflict (CWE-436) leading to SQL Injection and Remote Code Execution.
  • Affected Versions:
    • WordPress versions 6.9.x before 6.9.5
    • WordPress versions 7.0.x before 7.0.2
  • Attack Vector: Network (AV:N), Low Attack Complexity (AC:L), No Privileges Required (PR:N), No User Interaction (UI:N). CVSS 3.1 Base Score: 9.8 (CRITICAL).
  • Mechanism: The vulnerability chain involves two distinct issues:
    1. CVE-2026-63030: A REST API batch endpoint route confusion issue. This allows an attacker to manipulate how the batch endpoint processes requests.
    2. CVE-2026-60137: An author__not_in WP_Query SQL Injection. This SQLi can be triggered through the confused batch endpoint.
  • Exploitation: An unauthenticated attacker can leverage the route confusion to inject malicious SQL queries via the author__not_in parameter. This SQL injection can then be escalated to achieve Remote Code Execution, potentially leading to webshell deployment or direct command execution. Tools like CMSmap have been linked to exploitation attempts.

Detection

  • Web Server Logs: Monitor web server access logs for unusual requests to WordPress REST API batch endpoints, specifically wp-json/batch/v1/ or similar paths, containing suspicious parameters (e.g., author__not_in) or large, malformed POST bodies.
  • Process Creation: Look for unexpected child processes spawned by the web server process (e.g., httpd, nginx, w3wp.exe, php-cgi.exe). Specifically, monitor for cmd.exe, powershell.exe, sh, or bash being executed.
  • File System Monitoring: Detect creation of suspicious files (e.g., .php, .asp, .jsp files) in WordPress web root directories, particularly wp-content/uploads/ or wp-includes/, by the web server process. These could indicate webshell deployment.
  • Database Logs: If available, monitor database logs for unusual or malformed SQL queries, especially those targeting user or option tables, originating from the WordPress application.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress REST API Batch Endpoint Suspicious Request

title: WordPress REST API Batch Endpoint Suspicious Request
id: 9283e01a-f1c2-4a7b-a1c3-2d4e5f6g7h8i
status: experimental
description: Detects suspicious requests to the WordPress REST API batch endpoint, potentially indicating exploitation attempts for CVE-2026-63030 chained with CVE-2026-60137.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1/'
    cs-method: ['POST', 'PUT']
    c-uri|contains: 'author__not_in'
  condition: selection
level: high

Web Server Spawning Shell Process

title: Web Server Spawning Shell Process
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects a web server process spawning a shell interpreter, indicative of successful Remote Code Execution (RCE).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: 
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\pwsh.exe'
  condition: selection
level: critical

Web Server Creating Suspicious File in WordPress Directories

title: Web Server Creating Suspicious File in WordPress Directories
id: f0e9d8c7-b6a5-4321-fedc-ba9876543210
status: experimental
description: Detects a web server process creating suspicious files (e.g., webshells) in common WordPress upload or include directories, a common post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-includes\'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
      - '.asp'
      - '.aspx'
      - '.jsp'
      - '.jspx'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade WordPress to version 6.9.5 or 7.0.2, or later, as soon as possible. These versions contain the necessary fixes for both CVE-2026-63030 and CVE-2026-60137.
  2. Restrict REST API Access: If feasible and not critical for site functionality, consider limiting access to the WordPress REST API endpoint (/wp-json/) at the web server or WAF level, especially for unauthenticated users.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known SQL injection patterns and suspicious requests targeting WordPress REST API endpoints.
  4. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Regular Backups: Maintain regular, tested backups of WordPress sites and databases to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-63030
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1059.003 — Windows Command Shell
  • T1059.004 — Unix Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,319 input / 2,116 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged batch api exploitation, cmsmap, critical, cve-2026-60137, cve-2026-63030, pre-authentication, rce, sql injection, vulnerability, webshell, wordpressLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.