WordPress Patches Critical RCE Vulnerability in Imagick Extension WordPress has released version 7.0.4, a security update addressing a remote code execution (RCE) vulnerability (CVE-2026-65640, GHSA-8vr3-7mxf-gx8w) in sites using the Imagick extension with Ghostscript. The flaw, disclosed by researchers at pwn.ai, allows authenticated Author-level users to execute arbitrary code via crafted file uploads. The vulnerability stems from ImageMagick’s handling of non-image files, such as PostScript, EPS, and PDFs, which it processes using Ghostscript a tool historically prone to exploitation. WordPress’s WP_Image_Editor_Imagick::load() method previously relied on file extensions rather than content inspection, enabling attackers to bypass checks by disguising malicious payloads (e.g., a `.png` file containing PostScript code). Exploitation was possible through alternate upload paths, including XML-RPC’s `wp.uploadFile` and MP3 cover-art extraction, which skipped WordPress’s `wp_check_filetype_and_ext()` validation. The patch (commit 7daaa50) now scans file headers to block PostScript, EPS, fake PDFs, and compressed formats, while also stripping format specifiers (e.g., `EPS:innocent.png`) that could force unsafe decoding. While the flaw requires Author-level access, sites with multi-author or open contributor models face heightened risk. WordPress has backported fixes to the 4.7 branch and the upcoming 7.1 RC3, though only the latest version receives full support. Administrators are advised to update immediately, particularly on sites with broad upload privileges.

CISA Warns of Actively Exploited WordPress Core SQL Injection Flaw The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-60137, a critical SQL injection vulnerability in WordPress Core, to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in real-world attacks. The flaw stems from improper input validation in database queries, allowing attackers to manipulate SQL statements particularly when themes or plugins fail to sanitize untrusted data. The vulnerability poses a severe risk, especially for internet-facing WordPress instances, as it can be chained with CVE-2026-63030 an interpretation conflict flaw in WordPress Core to achieve unauthenticated remote code execution (RCE) on default installations. This combination enables attackers to escalate attacks beyond data theft, potentially compromising entire systems. CISA designated both vulnerabilities as high-priority threats, adding them to the KEV catalog on July 21, 2026. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch (FCEB) agencies must apply patches or mitigations by August 4, 2026. The agency urges all organizations to assess exposure, prioritize internet-facing systems, and follow vendor guidance including temporary mitigations or service suspensions if patches are unavailable. WordPress’s widespread use across enterprises, government, and small businesses makes these flaws particularly concerning. Threat actors frequently target the platform due to its plugin ecosystem and common misconfigurations, which expand attack surfaces. Automated scanning tools are already being used to identify vulnerable installations, with attackers leveraging SQL injection to extract data or prepare for further exploitation. Security researchers emphasize the need for immediate updates to patched WordPress versions, audits of plugins/themes for secure coding practices, and the deployment of web application firewalls (WAFs) to block malicious input. Database query logging and behavioral monitoring can also aid in detecting exploitation attempts. The inclusion of CVE-2026-60137 in CISA’s KEV catalog underscores its urgency, as confirmed attacks highlight the growing threat to web infrastructure.

Critical "wp2shell" RCE Vulnerability in WordPress Core Exposes 500M+ Sites to Takeover A severe pre-authentication remote code execution (RCE) flaw, dubbed wp2shell, has been discovered in WordPress Core, leaving over 500 million websites vulnerable to full compromise by unauthenticated attackers. Security researcher Adam Kues of Searchlight Cyber’s Assetnote team identified the bug, which stems from a REST API batch-route confusion issue leading to SQL injection and, ultimately, RCE. The vulnerability is particularly dangerous because it requires no prior access, plugins, or special configurations only a reachable WordPress instance running an affected version. Exploiting it allows attackers to execute arbitrary code without authentication, making it a zero-click threat. Affected Versions & Patches The flaw impacts WordPress versions 6.9.0–6.9.4, 7.0.0–7.0.1, and 7.1 beta (pre-release). Two CVEs track the issue: - CVE-2026-60137 (SQL injection, also affecting WordPress 6.8.x before 6.8.6) - CVE-2026-63030 (batch-route RCE, reported by Kues) WordPress has released 7.0.2, 6.9.5, and 6.8.6 to address both flaws, with auto-updates force-pushed to affected sites due to the severity. Manual updates are also available via the WordPress Dashboard or direct download. Mitigation & Workarounds While patching is strongly recommended, temporary measures include: - Blocking anonymous REST API access via plugin. - Restricting access to `/wp-json/batch/v1` and `?rest_route=/batch/v1` endpoints at the WAF level. The WordPress security team credited researchers TF1T, dtro, and haongo for the SQL injection discovery, alongside Kues for the RCE chain. Technical exploit details remain undisclosed to prevent immediate exploitation.

Outdated PHP Versions Leave Majority of WordPress Sites Vulnerable to Attacks A recent analysis by Censys has uncovered a critical security gap in the global web ecosystem, revealing that over 70% of publicly accessible WordPress sites are running outdated, end-of-life (EOL) PHP versions. As of June 2026, WordPress powers more than 40% of all websites over 59 million instances making this a widespread and systemic issue. The research examined 316,500 WordPress deployments with visible version data and found that only 30% were using supported PHP versions. The majority relied on deprecated releases, including PHP 7.4, which reached EOL in November 2022. While WordPress core updates were more frequently applied with 31% of sites running supported versions (6.9 or higher) and 14% on the latest release (7.0) the underlying PHP runtime remained neglected, creating a significant security blind spot. Outdated PHP versions expose sites to unpatched vulnerabilities, lack of security support, and compatibility issues with modern defenses. Since PHP underpins WordPress themes and plugins, weaknesses at this level can compromise the entire application stack. Attackers are actively exploiting this gap, targeting legacy environments that are easier to breach at scale. Operational challenges contribute to the problem, as site owners often delay upgrades due to concerns about breaking functionality, plugin incompatibilities, and complex migration paths. The issue is further exacerbated by inconsistent plugin patching less than 22% of Yoast SEO users, for example, run the latest version. Plugins introduce additional risks, with high-profile tools like UpdraftPlus facing multiple critical vulnerabilities, including authentication bypass and data exposure flaws. Real-world consequences are evident in ongoing attack campaigns, such as the "Hacked By MR.GREEN" defacement operation, which has compromised over 900 WordPress sites since 2020. These attacks exploit outdated software, misconfigurations, and exposed endpoints like xmlrpc.php, with continuous scanning activity targeting vulnerable sites. While the campaign focuses on defacement rather than financial gain, it demonstrates how low-sophistication threats can achieve widespread impact when basic security hygiene is ignored. The findings underscore the need for organizations to address both application and infrastructure layers, ensuring regular PHP updates, proactive plugin management, and secure configurations to reduce exposure.

Critical RCE Vulnerability in Everest Forms Pro Plugin Exploited in the Wild Hackers are actively exploiting a severe remote code execution (RCE) vulnerability in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300 (CVSS 9.8). The flaw, affecting all versions up to 1.9.12, allows unauthenticated attackers to execute arbitrary PHP code on vulnerable websites by manipulating form inputs. The vulnerability stems from the plugin’s "Complex Calculation" feature, where the `process_filter()` function dynamically constructs and evaluates PHP code using `eval()`. Despite input sanitization via `sanitize_text_field()`, the function fails to escape single quotes, enabling attackers to inject malicious payloads through standard form fields (text, email, URL, select, radio). By appending a single quote followed by arbitrary PHP code, threat actors can bypass security controls and gain server-side execution. Publicly disclosed on March 30, 2026, after a patch was released on March 18, 2026, the flaw saw active exploitation beginning April 13, 2026. Wordfence reported blocking over 29,300 exploitation attempts, with a sharp spike of 17,900 attacks on May 16 alone. Attackers primarily exploit the `/wp-admin/admin-ajax.php` endpoint via crafted POST requests, targeting websites with the Complex Calculation feature enabled. Observed attack patterns include the creation of rogue administrator accounts, such as the username "diksimarina", using WordPress’s `wp_insert_user()` function. Once administrative access is obtained, attackers deploy webshells, backdoors, or further compromise the hosting environment. Multiple malicious IPs have been identified, including: - 202.56.2[.]126 (tens of thousands of blocked requests) - 209.146.60[.]26 (thousands of exploit attempts) - 15.235.166[.]18 (hundreds of malicious requests) - 2402:1f00:8000[:]800::40db (IPv6-based attacks) - 185.78.165[.]153 (hostile scanning activity) While Wordfence provided early protection via firewall rules (February 27 for paid users, March 29 for free users), full mitigation requires updating to version 1.9.13. Indicators of compromise include unauthorized admin accounts and suspicious requests from known malicious IPs. The low barrier to exploitation and active campaign make this a high-impact threat to WordPress environments.

High-Severity SQL Injection Flaw in Ally WordPress Plugin Exposed 246,600 Sites A critical SQL injection vulnerability (CVE-2026-2413) in the Ally WordPress plugin a web accessibility tool from Elementor left approximately 246,600 websites vulnerable to data theft. The flaw, discovered by security researcher Drew Webber of Acquia, allowed unauthenticated attackers to inject malicious SQL queries into databases, enabling the extraction of sensitive information via time-based blind SQL injection techniques. The vulnerability, rated 7.5/10 (high severity), affected all versions of Ally up to 4.0.3. It was patched on February 23 with the release of version 4.1.0. Despite over 400,000 active installations, only 38.4% (153,600 sites) had updated to the secure version at the time of disclosure, leaving the majority exposed. WordPress, which has long emphasized the security risks posed by third-party plugins, urged users to immediately update both Ally and the core platform. WordPress 6.9.2, released recently, addressed 10 vulnerabilities, including XSS, authorization bypass, and SSRF flaws. The incident underscores the persistent threat of plugin-based vulnerabilities in the WordPress ecosystem, where outdated or unsupported extensions remain a primary attack vector.

Russian Threat Actor Exploits Jailbroken Google Gemini in Multi-Year AI-Assisted Fraud Campaign A Russian-speaking threat actor, tracked as bandcampro, leveraged a jailbroken instance of Google Gemini to orchestrate a sophisticated, AI-driven fraud and credential theft operation active since 2021. The campaign targeted politically engaged audiences, particularly those aligned with QAnon and MAGA movements, through a Telegram channel (@americanpatriotus) impersonating a U.S. military veteran. By 2024, the channel had amassed 17,000 subscribers. The attacker used the compromised AI model to crack WordPress administrator credentials, enabling access to backend systems where persistent credentials were stored. These stolen credentials were then exploited to drain at least one victim’s cryptocurrency wallet, demonstrating the high-impact risks of unsecured legacy data storage. The operation was executed at near-zero cost, relying on stolen API keys and AI-driven automation to scale attacks. The incident highlights a critical shift in the threat landscape: offensive AI tools are now fast, cheap, and accessible, rendering traditional perimeter defenses ineffective. The breach underscores the vulnerability of static credential storage where sensitive data remains exposed long after initial access rather than just the jailbreak itself. Experts warn that without transitioning to zero-persistence architectures, where sensitive data exists only in volatile memory for brief transaction windows, such attacks will continue to pose existential risks to enterprises. The case also reveals how AI lowers the barrier for threat actors, enabling large-scale influence operations, phishing, and credential theft with minimal technical expertise. The actor’s infrastructure, uncovered in early 2024, serves as a stark example of how AI-assisted cybercrime is evolving beyond traditional hacking into low-cost, high-impact campaigns.