WordPress Core security vulnerabilities (CVE-2026-60137, CVE-2026-63030): What you need to do

WordPress has released security updates to address two vulnerabilities affecting WordPress Core:

• CVE-2026-60137 – An SQL injection vulnerability.
• CVE-2026-63030 – A vulnerability affecting the WordPress REST API batch processing endpoint.

Individually, these vulnerabilities have a limited impact. However, security researchers discovered they can be combined to create a remote code execution (RCE) attack. This means an attacker could potentially run malicious code on a vulnerable WordPress website without needing to log in.

Because this vulnerability chain is being actively exploited, WordPress has released security updates and we strongly recommend updating your site as soon as possible.

What are these vulnerabilities?

These vulnerabilities affect WordPress Core, which is the software that powers every WordPress website. They do not affect 20i's hosting platform.

The first vulnerability (CVE-2026-60137) is an SQL injection (SQLi) issue. SQL injection vulnerabilities allow attackers to manipulate database queries in ways that weren't intended, potentially giving them access to information or functionality they shouldn't have.

The second vulnerability (CVE-2026-63030) affects the REST API batch endpoint, a feature that allows multiple API requests to be processed together. Researchers found that, when combined with the SQL injection vulnerability, it could be used to execute arbitrary code on a vulnerable website.

This type of attack is particularly serious because it may allow an attacker to:

• Gain unauthorised access to a website.
• Install malicious files or malware.
• Create administrator accounts.
• Modify website content.
• Use the website to launch further attacks.

The good news is that updating WordPress to a patched version removes the vulnerabilities and protects your website from this attack chain.

Is my website affected?

The vulnerabilities affect WordPress Core - not a plugin, theme or the hosting platform.

Your website may be affected if you're running one of these versions:

The vulnerabilities have been fixed in:

• WordPress 6.8.6
• WordPress 6.9.5
• WordPress 7.0.2
• All later releases

What should I do?

Update WordPress immediately

Updating WordPress is the only permanent fix.

WordPress has automatically applied security updates to many supported installations, but you should still verify that your website is running a patched version.

To check your version:

1. Log in to your WordPress admin dashboard.
2. Go to Dashboard > Updates.
3. Confirm you're running one of the patched versions listed above.
4. If an update is available, install it immediately.

Update plugins and themes

Although these vulnerabilities affect WordPress Core, you should also keep your plugins and themes fully up to date. Running the latest versions helps reduce your overall security risk and ensures compatibility with the latest version of WordPress.

Run a malware scan

We recommend running a malware scan using 20i's free Malware Scanner tool. More information on how to perform a Malware Scan can be found here

Check for signs of compromise

If your site remained on a vulnerable version after these vulnerabilities became public, it's worth checking for signs that it may have been compromised.

Look out for:

• Unknown administrator accounts.
• Unexpected plugins or themes.
• Suspicious PHP files.
• Unexpected website changes or redirects.
• Malware warnings from browsers or search engines.

If you suspect your site has been compromised, update WordPress immediately, change all administrator passwords, remove anything you don't recognise, and restore from a known-good backup if necessary.

Does this affect 20i's hosting platform?

No.

These are vulnerabilities in WordPress Core, not the 20i hosting platform or our infrastructure.

If your website is running a supported, patched version of WordPress, it is protected against these vulnerabilities.

Frequently asked questions

Is this a plugin vulnerability?

No. Both vulnerabilities exist in WordPress Core itself.

Is disabling the REST API enough?

No. While limiting access to the affected REST API endpoint may reduce exposure in some environments, this should only be treated as a temporary mitigation. Updating WordPress is the recommended and permanent solution.

My site updated automatically. Do I still need to check?

Yes. Whilst it is very likely that an automatic update has resolved the issue and mitigated any potential risk, we still recommend confirming that the update completed successfully and that your site is running the latest security release.