Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief #138 July 29, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today, we're covering one of the most significant WordPress vulnerabilities in recent years. Not because it affects a popular plugin or theme, but because the weakness exists within WordPress core itself. That distinction matters. For years, organizations have focused on patching vulnerable plugins and removing outdated themes. In this case, even a default WordPress installation can be exposed if it is running a vulnerable version. Here's what happened Security researchers identified a vulnerability chain known as WP2 shell. Which combines two separate flaws within WordPress Core into a single remote code execution attack. The first vulnerability, CVE-2026-63030, affects the WordPress REST API batch routing functionality. The second, CVE-2026-60137, is a SQL injection vulnerability within WordPress Core. Individually, each vulnerability is serious. When chained together, they allow an attacker to progress from an anonymous web request to To executing arbitrary code on the web server without requiring authentication. That means the attacker does not need a WordPress account, they do not need administrator credentials, they do not need a vulnerable plugin, and they do not need prior access to the hosting environment. If the target is running a vulnerable version, the opportunity exists. The affected versions include WordPress 6.8.0 6.8.5, 6.9.0 through 6.9.4. And 7.0.0 through 7.0.1. WordPress has released patched versions 6.8.6, 6.9.5, and 7.0.2, and enabled forced automatic updates for affected installations. However, organizations should not assume those updates were successfully applied. Administrators should manually verify every internet-facing WordPress installation, including staging environments, archived sites, forgotten subdomains, and websites managed by third parties. What elevates this from a routine patching exercise is the change in the threat landscape. Initial disclosures indicated there was no confirmed exploitation. That is no longer the case. Security reporting now confirms that the WP2 shell vulnerability chain is being exploited and public proof of concept code has been released. The availability of exploit code dramatically lowers the barrier to entry, making widespread automated scanning and exploitation far more likely. NHS England's National Cybersecurity Operations Center. Has assessed that further exploitation is highly likely, meaning organizations should move beyond vulnerability management and begin validating whether compromise has already occurred. Successful exploitation can have serious consequences. Attackers may install persistent web shells, create administrator accounts, modify themes or plugins, steal database credentials, access API keys and cloud secrets, inject malicious PHP code, host phishing pages, distribute malware. Or use the compromise server as a stepping stone into connected business systems. For many organizations, a WordPress server contains credentials for databases, email services, payment platforms, analytics tools, cloud storage, and other critical infrastructure. Compromising the website may therefore provide a pathway into the wider enterprise environment. So what should organizations do now? First, immediately update affected WordPress installations to the latest security releases. Second, manually verify that updates have actually been applied. Third, Review administrator accounts for unfamiliar users, inspect recently modified PHP files, examine web server logs for suspicious REST API requests, and search for web shells or unexpected scheduled tasks. If there is any indication that the website was publicly accessible while running a vulnerable version, organizations should consider the possibility of compromise, rotate administrator, database, hosting, SSH, FTP, API, and cloud credentials where appropriate. And perform a structured incident response investigation before returning the system to production. The strategic lesson is clear. Cybersecurity is no longer just about patching third-party components. When vulnerabilities emerge in the core of one of the world's most widely deployed platforms, every organization running that software becomes part of the potential attack surface. Security leaders should ensure they maintain a complete inventory of every WordPress installation across production, development, staging, archived projects, and subsidiary websites. Because you cannot protect systems you do not know exist. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.