Security researchers have found two serious flaws in WordPress — the software that powers roughly 40% of all websites on the internet, including blogs, small business sites, and online stores. The two bugs (tracked as CVE-2026-63030 and CVE-2026-60137) work together to let a complete stranger run harmful code on a vulnerable site without ever needing a username or password. Attackers only need to send a specially crafted web request to the site to trigger the attack. Public proof-of-concept exploit code is already circulating online, meaning automated attacks are likely to start soon if they haven’t already.
WordPress has already released patches that close both holes. Updated versions 6.8.6, 6.9.5, and 7.0.2 are available now. If you own or manage a WordPress website — whether it’s a personal blog, a portfolio, or a client site — updating takes about 30 seconds and should be done immediately.
How to check if you’re affected
Affected versions include WordPress 6.8.0 through 7.0.1 across three release families. Check your version and update like this:
- Log in to your WordPress admin dashboard and look for an “Update Available” banner at the top of any screen.
- Click Dashboard → Updates in the left sidebar to see your current version number.
- If you are on any version from 6.8.0 to 7.0.1, click Update Now to install 6.8.6, 6.9.5, or 7.0.2 — whichever applies to your site.
If your site is hosted on a managed WordPress platform (such as WordPress.com, WP Engine, Kinsta, or Bluehost), check your hosting dashboard or contact your host’s support — many managed hosts push critical security updates automatically. If you are unsure of your version, your host can confirm it.