security
Plus dozens of PoCs in the public domain
If you use WordPress, patch now. Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow pre-authentication remote code execution (RCE). And security researchers tell us there’s a very good chance the miscreants had an AI assist.“Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was only a matter of time and tokens,” Jake Knott, watchTowr principal security researcher, told The Register. “WatchTowr was able to trivially reproduce CVE-2026-63030 within minutes of disclosure, and the second CVE-2026-60137 with some additional effort.”WordPress released patches for both CVEs late Friday, but by Saturday it was game over.
“By the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said. “From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.”
Here are the details about both security holes, and what went down since WordPress revealed and fixed them on Friday.CVE-2026-60137 is a moderate-severity SQL injection issue, and CVE-2026-63030 is a critical REST API batch-route confusion bug.“A route confusion flaw causes the arrays containing the sub-requests, validation results, and matched handlers to become misaligned,” Hacktron researchers explained. This causes WordPress to become confused about which requests have been properly validated and thus treat all requests as trusted, including those that it should block. Individually, the bugs are difficult to exploit. But when chained together, they can wreak havoc on any organization using a vulnerable WordPress version because they allow unauthenticated RCE.
