CISA Warns of Actively Exploited Critical WordPress Core SQL Injection Flaw

Key Takeaways

• A critical SQL injection vulnerability in WordPress Core (CVE-2026-63030) is being actively exploited.
• The flaw, dubbed “wp2shell,” can be chained with another SQL injection vulnerability (CVE-2026-60137) found in plugins or themes.
• Successful exploitation of these chained vulnerabilities could lead to full remote code execution, allowing attackers complete control of affected WordPress sites.
• The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVEs to its Known Exploited Vulnerabilities catalog and mandated remediation for federal agencies.
• WordPress site administrators should apply available patches immediately and implement robust security measures.

CISA Alerts to Active Exploitation of Critical WordPress Core SQL Injection Flaw

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning regarding an actively exploited SQL injection vulnerability within WordPress Core. This critical flaw could enable attackers to compromise websites and potentially achieve remote code execution, posing a significant threat to a vast number of online platforms.

Details of the Vulnerability

Designated as CVE-2026-63030, this vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026. Its inclusion in the KEV catalog signifies confirmed in-the-wild exploitation, underscoring the immediate risk to organizations utilizing WordPress.

The core issue, categorized under CWE-436, stems from an interpretation conflict within WordPress Core. This conflict leads to inconsistencies in how user input is processed, thereby allowing malicious SQL queries to be injected and executed. Attackers can leverage this flaw to manipulate backend database operations, potentially exposing sensitive data or altering the application’s intended behavior.

Chaining Vulnerabilities for Remote Code Execution

Security researchers have highlighted that CVE-2026-63030, also known as “wp2shell,” becomes particularly dangerous when combined with CVE-2026-60137. The latter is a SQL injection vulnerability classified as CWE-89, which arises when WordPress plugins or themes pass untrusted user input into database queries without adequate sanitization.

While SQL injection vulnerabilities are frequently associated with insecure coding practices in third-party extensions, the severity of CVE-2026-60137 is amplified because it affects default WordPress installations when exploited in conjunction with the core flaw. When these two vulnerabilities are chained, unauthenticated attackers may be able to escalate from a simple SQL injection to full remote code execution. This means threat actors could potentially gain complete control of affected WordPress websites without requiring any valid credentials.

Potential Impact and CISA Directives

Such comprehensive access could be utilized for various malicious activities, including deploying web shells, injecting malicious scripts, redirecting users to phishing pages, or using compromised servers as launchpads for further attacks. Although CISA has not confirmed the use of these vulnerabilities in ransomware campaigns, the agency emphatically states that active exploitation has already been observed in the wild.

Given WordPress’s widespread adoption across the internet, the potential attack surface is immense, making this vulnerability highly attractive to both opportunistic and sophisticated threat actors. CISA has mandated that federal civilian executive branch agencies remediate CVE-2026-63030 by July 24, 2026, and CVE-2026-60137 by August 4, 2026, under Binding Operational Directive (BOD) 26-04. This directive emphasizes a risk-based approach to patching, requiring immediate action to secure vulnerable systems. CISA also advises adherence to its Forensic Triage Requirements to detect potential compromises and assess the impact of exploitation.

What You Should Do

• Apply Patches Immediately: WordPress site administrators and security teams must apply vendor-provided patches as soon as they become available for both WordPress Core and any affected plugins/themes.
• Evaluate Exposure: If patches are not yet released, assess your site’s exposure, restrict access to critical systems, and consider temporarily disabling vulnerable components.
• Monitor for Exploitation: Actively monitor database queries, web server logs, and unusual administrative activity for any signs of compromise.
• Implement Defense-in-Depth: Reinforce security with strict input validation, deploy Web Application Firewalls (WAFs), and maintain a continuous vulnerability management program.
• Follow CISA Guidance: Refer to CISA’s official advisories and follow their Forensic Triage Requirements if you suspect a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.