Back to feed
Dev.to
Dev.to
7/19/2026
WordPress 7.0.2 — Patching an Unauthenticated RCE Chain Right Now

WordPress 7.0.2 — Patching an Unauthenticated RCE Chain Right Now

Short summary

WordPress 7.0.2 patches a critical unauthenticated RCE chain (WP2Shell) combining CVE-2026-60137 (SQL injection in WP_Query) and CVE-2026-63030 (REST API batch route confusion). The chain allows remote code execution on default installations without plugins or accounts. Public PoC code exists and in-the-wild exploitation has been reported. Sites running WordPress 6.9 through 7.0.1 without persistent object cache are at highest risk and should patch immediately.

  • •WP2Shell chain combines SQLi and REST API route confusion for unauthenticated RCE on default WordPress
  • •Public PoC code exists; active exploitation attempts reported within hours of disclosure
  • •Patch to 7.0.2 immediately; block /wp-json/batch/v1 at WAF level while staging updates

Generated with AI, which can make mistakes.

#ai-tools#regulation-policy
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

The original headline is: "Max-Severity Adobe ColdFusion RCE (CVE-2026-48282) Is Now Under Active Attack"
Dev.to
The original headline is: "Australian Cyber Security Centre Issues Alert on Mass Exploitation of CMS Vulnerabilities"
Dev.to
Microsoft patch record, agentic coding tool vulnerabilities, and what to run this week
Dev.to
The headline needs to preserve: 7-Zip, XZ, CVE-2026-14266, buffer overflow, patched/discovered. Let me count words and keep it tight.
Dev.to