Pakistan’s National Cyber Emergency Response Team (National CERT) has warned of a critical WordPress security threat. The vulnerabilities could let attackers take full control of websites without logging in. The warning covers public-facing websites across government, finance, critical infrastructure, and the private sector. National CERT has urged organizations to install the latest WordPress security updates immediately.
In its latest advisory, National CERT rated the threat as “Critical.” It also pointed to active exploitation attempts and publicly available proof-of-concept (PoC) code. The warning centers on two critical vulnerabilities, CVE-2026-63030 (wp2shell) and CVE-2026-60137. Attackers can reportedly chain these flaws to run malicious code on vulnerable servers.
The first vulnerability targets the WordPress REST API batch-route endpoint at /wp-json/batch/v1. Attackers can combine it with an SQL injection flaw in the WP_Query class. This combination could allow unauthenticated attackers to compromise websites and their underlying servers. As a result, organizations could face serious security and operational risks.
Serious Risks
National CERT gave the remote code execution vulnerability a CVSS score of 9.8. The SQL injection flaw received a CVSS score of 9.1. Both scores indicate highly severe security vulnerabilities. Moreover, the potential impact goes beyond taking control of individual websites.
Successful attacks could allow hackers to install persistent web shells and steal sensitive information. They could also change or deface official websites without authorization. In addition, attackers could move across enterprise networks after gaining access to a vulnerable server. The attacks could also disrupt digital public services and damage an organization’s reputation.
National CERT said exploitation activity started within hours after the vulnerabilities became public. This rapid activity highlights the need for organizations to act quickly. The remote code execution chain affects WordPress Core versions 7.0.0 through 7.0.1. It also affects versions 6.9.0 through 6.9.4.
Meanwhile, the SQL injection vulnerability affects WordPress 6.8.x and later versions. Organizations should upgrade to WordPress 7.0.2, 6.9.5, or 6.8.6. The correct update depends on the WordPress branch used by each organization. However, National CERT warned that organizations should not depend only on automatic updates.
Managed hosting services may delay or block important security patches in some cases. Therefore, administrators should manually check the WordPress version on every internet-facing installation.
Steps to Take
Organizations that cannot patch immediately should take additional steps to reduce the risk. National CERT recommends blocking the vulnerable REST API batch endpoint through web application firewalls (WAFs).
Administrators should also restrict unauthenticated API access where possible. They should update all plugins and themes during the same maintenance window. National CERT also recommends checking WordPress core files against official release checksums. This can help organizations find signs of unauthorized changes or tampering.
The advisory also calls for a detailed threat-hunting exercise. Security teams should review web server logs for unusual requests targeting /wp-json/batch/v1. They should also check writable directories, including /wp-content/uploads/, for unauthorized PHP files. Such files could indicate that attackers have installed a web shell.
Security teams should monitor web servers for unusual process activity as well. They should also look for unexpected outbound connections that may point to command-and-control activity. National CERT has asked organizations to audit all public-facing WordPress websites immediately. If a server is compromised, teams should isolate it and preserve forensic evidence.
After applying security updates, administrators should rotate all administrative credentials and database secrets. Organizations should also report confirmed incidents without delay.
National CERT has called for continuous monitoring and stronger detection measures across vulnerable environments. It has also urged organizations to report suspected attacks and confirmed compromises.
The warning highlights the growing risks facing organizations that rely on widely used content management systems. With exploit code publicly available and attacks already underway, vulnerable WordPress installations remain a serious security concern.
