Situation
WordPress recently announced a few vulnerabilities that were fixed.
- CVE-2026-63030
- CVE-2026-60137
Impact
These vulnerabilities could allow an attacker to run SQL injections and execute remote code on the websites.
Call to action
It is recommended that you update to the updated versions of WordPress to address this vulnerability.
WordPress news details the updated version to be applied to websites.
- 7.0.2 security release addresses a critical and high-severity issue
Supported mitigations
- Imunify360 (WAF rules 8.33, 8.32 - WPT-2656 WordPress Core: WAF protection against SQL injection and unauthenticated remote code execution (CVE-2026-60137, CVE-2026-63030)
- WordFence ( Premium, Care, and Response customers received on Jul 17th - Free customers receive the update by August 16th, 2026 )
- CloudFlare ( Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities )
Emergency mitigations
CPANEL_WARN: The following may have an unexpected impact on the legitimate use of the sites and should only be used as an emergency or temporary measure until the sites can be updated.
- WP Plugin from wp2shell ( wp2shell )
- Block "/wp-json/batch/v1" and "?rest_route=/batch/v1" with a custom WAF or Mod Security rule
Comments
0 comments
Article is closed for comments.