CISA puts WordPress wp2shell RCE in KEV with July 24 deadline

CISA has added both WordPress Core wp2shell vulnerabilities to the Known Exploited Vulnerabilities catalog. CVE-2026-63030 carries a July 24, 2026 remediation date for covered U.S. federal agencies, while CVE-2026-60137 carries an August 4, 2026 date.

This is not a plugin cleanup story. The WordPress GitHub advisories place the vulnerable package in WordPress Core and list patched versions across the 7.0, 6.9, and 6.8 branches.

WordPress Core is the exposure, not a third-party plugin

The WordPress advisories describe two linked issues. The first is a facilitated SQL injection issue in the author__not_in parameter of WP_Query, tracked as CVE-2026-60137. The second is CVE-2026-63030, a REST API batch-route confusion issue that can lead to remote code execution when chained with the SQL injection flaw.

The affected branches are precise. WordPress 7.0.0 through 7.0.1 and 6.9.0 through 6.9.4 are affected by both vulnerabilities. WordPress 6.8.0 through 6.8.5 is affected by CVE-2026-60137 and has a separate backport fix.

The patched versions are 7.0.2, 6.9.5, and 6.8.6. Sites on the 7.1 beta line need 7.1 beta2.

CISA sets two remediation clocks

CISA's KEV catalog marks both CVEs as added on July 21, 2026. The shorter deadline is CVE-2026-63030: July 24. CVE-2026-60137 has an August 4 deadline.

For federal civilian agencies, those dates matter directly under CISA's binding directive process. For everyone else, KEV is still a strong prioritization signal: CISA only adds vulnerabilities to the catalog when it has evidence of active exploitation, a clear remediation action, and a relevant risk to organizations.

The practical order is simple. Internet-facing WordPress 6.9.x and 7.0.x installations deserve immediate verification because they sit in the full chain path. WordPress 6.8.x installations still need the SQL injection fix, even though the release notes scope the full RCE chain to 6.9 and later.

Auto-update is not proof of remediation

WordPress enabled forced updates through its auto-update system, but operators should still check final versions. Hosts can disable background updates, filesystem permissions can block writes, and managed hosting platforms sometimes stage or defer changes.

Check the WordPress dashboard, CLI inventory, host control panel, or fleet scanner for the exact core version. Then confirm that security tooling no longer reports CVE-2026-63030 or CVE-2026-60137 on exposed sites.

For high-value or already suspicious sites, patching should not end the incident workflow. Review web server logs around July 17 through July 22, look for unexpected administrator creation, plugin/theme changes, new PHP files, altered cron entries, and outbound connections from the web server. Tenable and other security firms report public exploitation activity and public proof-of-concept circulation, so stale sites may have been reachable during the disclosure window.

What site owners should do now

Update affected sites to 7.0.2, 6.9.5, or 6.8.6. If a site cannot update immediately, remove it from public exposure until it can. Do not treat "no plugins installed" as a defense; the chain is about WordPress Core behavior.

Agencies and contractors tracking KEV deadlines should document remediation for CVE-2026-63030 by July 24 and CVE-2026-60137 by August 4. Commercial teams should use the same dates as escalation points for customer-facing sites, agency-adjacent environments, and high-traffic publishing properties.

For broader security operations, add the two CVEs to vulnerability management dashboards, confirm hosting providers have applied the backports, and keep a short exception list for sites that cannot yet move. The key unresolved question is not whether a patch exists. It is whether every exposed WordPress install actually received it.

Evidence

CISA lists CVE-2026-63030 and CVE-2026-60137 in KEV with active exploitation status and remediation due dates. GitHub's WordPress advisories provide the CVE/GHSA records, affected branches, and patched version ranges. Tenable adds independent context on exploitation activity and public proof-of-concept availability.