Get all your news in one place.
100's of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

Experts warn millions of WordPress websites could be at risk following reveal of worrying bugs

Wordpress brand logo on computer screen. Man typing on the keyboard.
  • WordPress patches two flaws: CVE‑2026‑60137 (SQL injection, medium severity) and CVE‑2026‑63030 (REST API batch‑route confusion, critical severity)
  • When chained, the bugs enabled unauthenticated remote code execution, allowing full site takeover
  • Admins should urgently upgrade to WordPress 6.9.5 or newer to protect against widespread active attacks

Millions of WordPress websites could be at serious risk, researchers are warning, due to two recently patched vulnerabilities that are being actively exploited in the wild.

Sign up to read this article
Read news from 100's of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.