WordPress sites can be hijacked remotely
A serious flaw in WordPress lets attackers run code on your site if they guess a few details. This can let them steal data, add fake pages, or lock you out.
- Severity
- CriticalCVSS 3.1 ยท 9.8
- Fix
- Fixed in 6.9.5Fix recorded on Aug 26, 2026
- Affected versions
- 6.9.0 to before 6.9.5; 7.0.0 to before 7.0.2
- Weakness
- CWE-436
- Exploit likelihood
- 97% in 30 daysEPSS, higher than 100% of known flaws
- Affects
- WordPress
- Exploited
- Yes, in the wildListed by CISA
- Added to CISA list
- Jul 21, 2026
- Federal fix deadline
- Jul 24, 2026
How it works
An attacker sends a specially crafted request to a WordPress site's search or comment form, tricking the site into running commands on its own server.
What to do
Check the installed WordPress version. This advisory applies to 6.9 to before 6.9.5 or 7.0 to before 7.0.2.
Update WordPress to 6.9.5 or 7.0.2 or newer. Then verify the installed version.
Technical details
A critical unauthenticated remote code execution (RCE) vulnerability, tracked as CVE-2026-63030, affects WordPress Core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The flaw allows attackers to execute arbitrary code on vulnerable sites by exploiting the WordPress REST API batch endpoint, bypassing authentication entirely. The vulnerability is fixed in 6.9.5, 7.0.2, and 7.1 Beta 2.
Researchers at Searchlight Cyber disclosed the issue on July 17, 2026, noting it can be triggered against default WordPress installations without requiring additional plugins. The vulnerability's CVSS score is 7.5, though the GitHub advisory classifies it as critical. No public proof-of-concept or in-the-wild exploitation has been confirmed as of the advisory's publication.
Severity breakdown
- Attack vector Network Requires network access to the vulnerable service
- Attack complexity Low Low complexity under the assessed conditions
- Privileges required None Attacker needs no account or login
- User interaction None No victim action needed
- Scope Unchanged Impact stays within the same security authority
- Confidentiality impact High Sensitive data can be exposed with serious impact
- Integrity impact High Protected data can be changed with serious impact
- Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator