Govt warns of critical WordPress flaws exposing websites to takeover

Pakistan’s National Cyber Emergency Response Team (National CERT) has issued a high-severity cybersecurity advisory, warning that actively exploited vulnerabilities in WordPress Core could allow hackers to seize complete control of websites without requiring any login credentials or user interaction, placing thousands of public-facing portals at immediate risk.

In its latest advisory, National CERT classified the threat as “critical”, citing widespread exploitation attempts and the public availability of proof-of-concept (PoC) exploit code.

The advisory warned that government portals, critical information infrastructure (CII), financial institutions, enterprise websites, and all organisations running vulnerable WordPress installations should treat the threat as an emergency and immediately deploy the latest security updates.

According to the advisory, attackers can exploit a chain of two critical vulnerabilities—identified as CVE-2026-63030 (wp2shell) and CVE-2026-60137—to remotely execute arbitrary code on targeted servers.

The primary flaw exploits confusion in the WordPress REST API batch-route endpoint (/wp-json/batch/v1) and combines it with a SQL injection vulnerability in the WP_Query class, enabling unauthenticated attackers to compromise websites and underlying servers.

READ MORE: Defence, banking and power systems: National CERT flags cyber threats

National CERT assigned a CVSS score of 9.8 to the remote code execution vulnerability and 9.1 to the SQL injection flaw, describing both as among the most severe categories of cyber vulnerabilities.

The advisory cautioned that successful exploitation could lead to complete website takeover, deployment of persistent web shells, theft of sensitive data, unauthorised modification or defacement of official portals, lateral movement across enterprise networks, disruption of digital public services, and serious reputational damage for affected organisations.

It further warned that exploitation activity began within hours of the vulnerabilities becoming public, underscoring the urgency of immediate defensive measures.

The advisory identified WordPress Core versions 7.0.0 through 7.0.1 and 6.9.0 through 6.9.4 as vulnerable to the remote code execution chain, while the SQL injection issue affects WordPress 6.8.x and later.

Organisations have been directed to immediately upgrade to WordPress 7.0.2, 6.9.5, or 6.8.6, depending on their deployment branch.

National CERT also advised organisations not to rely solely on automatic updates, warning that managed hosting environments may delay or block critical security patches. Administrators have been urged to manually verify the software version of every internet-facing WordPress installation.

For organisations unable to patch immediately, the advisory recommends blocking access to the vulnerable REST API batch endpoint through web application firewalls (WAFs), restricting unauthenticated API access, updating all plugins and themes during the same maintenance window, and validating WordPress core files against official release checksums to detect any tampering.

The cyber watchdog also instructed organisations to conduct comprehensive threat hunting by examining web server logs for suspicious requests targeting /wp-json/batch/v1, monitoring for unauthorised PHP files in writable directories such as /wp-content/uploads/, detecting abnormal process execution by web servers, and identifying unexpected outbound communications that could indicate command-and-control activity.

As part of its incident response guidance, National CERT directed all organisations to immediately audit public-facing WordPress instances, isolate compromised servers, preserve forensic evidence, rotate administrative credentials and database secrets after patching, and report confirmed incidents without delay.

The advisory concluded with an urgent call for organisations to strengthen continuous monitoring, deploy enhanced detection mechanisms, and report any suspected exploitation attempts or confirmed compromises to National CERT to help contain the rapidly evolving threat landscape.