WordPress core RCE chain: CVE-2026-63030 + CVE-2026-60137 (pre-auth, PoC public, patches available) (Source: The Hacker News Weekly Recap (July 20, 2026))
The Chain: Two CVEs, No Plugins Required
A vulnerability chain disclosed this week, tracked as CVE-2026-63030 and CVE-2026-60137, combines a REST API batch-route confusion issue with a SQL injection flaw to reach pre-authenticated remote code execution on standard WordPress installations. No plugin or theme is required to trigger it, according to the recap published by The Hacker News on July 20, 2026, which noted proof-of-concept exploit code is already circulating publicly and that in-the-wild exploitation is beginning. WordPress released patches — core versions 6.8.6, 6.9.5, and 7.0.2 — on July 17, 2026, three days before the recap.
Affected Versions and Exposure
The full RCE chain affects WordPress core 6.9.0–6.9.4 and 7.0.0–7.0.1. Versions 6.8.0–6.8.5 are exposed to the SQL injection component (CVE-2026-60137) but not the full chain. Earlier branches (6.7 and below) are not implicated in this specific pair of vulnerabilities. For a site owner, the operative question is which core version is running and whether the July 17 patch has been applied — this is a core vulnerability, so plugin inventory is irrelevant to exposure.
Same Week, an AI-Infrastructure Botnet
The same recap described a campaign, referred to as NadMesh, that autonomously scans for and exploits exposed installations of ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio — six tools commonly used to run or orchestrate AI models — harvesting AWS keys and Kubernetes tokens from misconfigured instances. WebPulse's detection engine tracks roughly 30 web frameworks by HTML and HTTP signature and does not scan for these AI-tooling services, so no WebPulse detection data corroborates this specific campaign. What it does confirm, as a single week's observation rather than a claim about a sustained multi-week trend, is that the newest layer of web infrastructure, the services that host and serve AI models, is now drawing the same class of automated, opportunistic scanning that has targeted content management software for years.
What Changed, and What Didn't
WordPress's cumulative disclosed vulnerability count stands at 18,005, per NVD and NIST data collected for WebPulse's framework intelligence baseline in July 2026. That figure reflects roughly two decades of public disclosure on a large, open-source project with an extensive plugin surface, and is not a like-for-like measure against closed-source or newer platforms with different ages and install bases. This week's two additions do not meaningfully shift that cumulative total. What is notable is where they sit: core code, reachable without authentication, with no plugin dependency, which changes how a site owner should weigh exposure compared with a bug confined to an optional plugin.
What Budget Signers Should Note
WordPress core 6.8.6, 6.9.5, and 7.0.2 close this chain. Sites with auto-updates enabled may already be patched; those with managed hosting or manual update policies should confirm their running version against the affected ranges above. WebPulse's Tranco Top-10K census found WordPress on 22.4% of scanned high-traffic domains in July 2026, but that sample skews toward well-resourced sites with faster patch cycles — the broader, unranked WordPress install base, where manual updates are more common, is arguably the more exposed population for an unauthenticated core RCE. The broader recap this week — spanning a CMS core bug, VPN appliance zero-days, a collaboration-platform zero-day, and an AI-infrastructure botnet — shows exposure distributed across more categories of software than a single security function typically owns.
