WordPress has forced security updates for affected websites after two flaws in its core software were used together in attacks that can let an unauthenticated intruder take control of a vulnerable site.
The US Cybersecurity and Infrastructure Security Agency (CISA) added both vulnerabilities to its Known Exploited Vulnerabilities catalogue on 21 July 2026. The addition gives South African companies, public bodies, publishers and website operators a reason to verify that automatic updates completed, rather than treating the 17 July security release as routine maintenance.
There is no public evidence in the opened sources that identifies a South African victim or measures local exposure. The attack is nevertheless relevant to any South African organisation running one of the affected WordPress versions on an internet-facing site because the flaws sit in WordPress core, not in an optional plugin.
Two flaws form one takeover path
The more serious path combines CVE-2026-63030, a confusion flaw in the WordPress REST application programming interface, with CVE-2026-60137, a structured query language (SQL) injection flaw in the software's database-query code. WordPress's security advisory says the chain can lead to remote code execution, meaning an attacker can run commands on the server without first signing in.
The full chain affects WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1. The separate SQL-injection flaw also affects WordPress 6.8.0 through 6.8.5, but in that branch it requires a plugin or theme to pass untrusted input to the vulnerable parameter. Versions before 6.8 are not affected, according to the WordPress release notice.
The patched releases are WordPress 6.8.6, 6.9.5 and 7.0.2. WordPress said it enabled forced updates through its automatic update system because of the severity, while sites that support normal background updates should also begin updating automatically.
Attack attempts followed disclosure
The catalogue addition means CISA has evidence that both vulnerabilities have been exploited. The agency lists 24 July as the remediation deadline for CVE-2026-63030 and 4 August for CVE-2026-60137 under its rules for US federal agencies; those dates are not legal deadlines for South African organisations.
Independent security firms also reported attack activity. Patchstack said it had seen exploitation attempts in its logs, while cyber insurer Coalition said its honeypots — decoy systems used to observe attackers — captured attempts on 20 July. The Canadian Centre for Cyber Security updated its advisory on 21 July to record the CISA addition and urge administrators to apply the updates.
Neither CISA nor the vendor records identify the attackers, the number of compromised sites or whether the activity is linked to ransomware.
Verify the update and check for earlier access
South African teams responsible for WordPress sites should check the installed core version and confirm that each production instance reached the patched release for its branch. WordPress said its automatic background-update process would begin on sites that support it, but it still gave administrators a manual update path.
Updating closes the known flaws but does not establish whether a site was accessed beforehand. Coalition recommends that organisations with evidence or suspicion of earlier unauthorised access review logs and look for unexpected administrator accounts or newly installed plugins as part of an incident-response process.
The immediate next step is therefore twofold: confirm the patched version is running, and investigate any unexplained changes that predate the update. The available advisories do not provide a South African victim count, so operators should base their response on their own version inventory and evidence rather than assume local sites were either compromised or spared.