A critical WordPress flaw, your site can fall within hours
If your business runs on WordPress, this article matters to you more than usual. On 18 July 2026 CERT Polska announced a critical vulnerability in the WordPress engine itself, one that lets an attacker take over a site remotely, without logging in, without any plugin, on a completely default installation.
Why it is serious
The flaw (tracked as CVE-2026-63030) enables so-called remote code execution, in plain words, a stranger can run their own program on your server and take control of it. It comes with a second vulnerability (CVE-2026-60137) that affects even more sites.
CERT Polska expected mass exploitation of this flaw within hours of the announcement. This is not a "someday" threat, the attacks are happening now, automatically and on a mass scale.
The attack needs no account, no add-ons and no unusual settings. It is enough that the site runs a vulnerable version. The result can be a site takeover and theft of customer data.
Is your site at risk
The site-takeover vulnerability affects WordPress versions 6.9.0-6.9.4 and 7.0.0-7.0.1. The additional flaw also covers the 6.8.0-6.8.5 branch. The safe versions are:
- branch 6.8, updated to 6.8.6,
- branch 6.9, updated to 6.9.5,
- branch 7.0, updated to 7.0.2.
What to do right away
WordPress.org triggered forced, automatic updates, but there are many known cases where they did not work correctly. So do not assume it "probably sorted itself out".
- Check in the WordPress panel which version you have and whether the update actually ran.
- If not, update immediately to a safe version.
- If for some reason an update is not possible right away, access to the REST API needs to be temporarily restricted, but that is a job for someone who knows what they are doing, because it can break the site.
Not sure which version your site runs on, or whether it has already been compromised? This is exactly the moment to reach out. We will check your site, update it safely and verify that nobody has left themselves a back door.
Source: CERT Polska advisory 124/2026