WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has published a security release including WordPress 7.0.2 on July 17, 2026, to address multiple vulnerabilities that could lead to remote code execution when chained together.
The update resolves two specific issues tracked as CVE-2026-63030 and CVE-2026-60137. Security researchers determined that combining these flaws allows an attacker to execute arbitrary code remotely on vulnerable sites.
CVE-2026-60137 is an input validation weakness affecting certain functions. It can result in SQL injection when the application processes untrusted data supplied by plugins or themes.
CVE-2026-63030 arises from route interpretation confusion within the REST API batch endpoint. When exploited in conjunction with the SQL injection vulnerability, it enables remote code execution.
The CVE-2026-60137 issue affects the 6.8 branch and later, while CVE-2026-63030 exists in the 6.9 branch and later. Chained attacks are not possible on the 6.8 series according to the advisory.
Site administrators are strongly encouraged to update their installations without delay to protect against potential exploitation.
Related articles
WordPress Patches High-Severity XSS2Shell Flaw Enabling Remote Code Execution (CVE-2026-64638)
WordPress has released a fix for a high-severity vulnerability in its core that can turn a malicious login attempt into remote PHP code execution on the server. The flaw, tracked as CVE-2026-64638 and rated 8.9 on CVSS, is named XSS2Shell and begins as a reflected cross-site scripting issue on the authentication screen. An unauthenticated attacker can submit a specially crafted username that bypasses sanitization mechanisms due to differences in how PHP and WordPress interpret certain characters, allowing controlled HTML elements to be injected into the login page. This leads to JavaScript execution in the site domain, and when an authenticated administrator visits a prepared page, the attacker can abuse the existing session to authorize application credentials and upload arbitrary PHP code. The patch is included in WordPress 7.0.3 released on August 6, with backports available for branches as old as 4.7. No public exploitation has been confirmed yet, but the technical details make immediate updating a priority for site administrators.
Google Releases Chrome 151 Fixing 41 Vulnerabilities Including Six Critical Flaws
Google has issued Chrome 151 to address 41 security vulnerabilities, six of which are rated critical and could lead to memory corruption, browser crashes, and remote code execution. The update covers Windows, macOS, and Linux platforms with versions 151.0.7922.108 and 151.0.7922.109. Two use-after-free flaws in the WebGL component, tracked as CVE-2026-19137 and CVE-2026-19170, allow continued memory access after deallocation. Additional critical issues affect the Aura, Skia, Views, and ANGLE components under CVE-2026-19149, CVE-2026-19154, CVE-2026-19172, and CVE-2026-19157. Google has withheld technical details and proof-of-concept code for several flaws to limit exploitation while the rollout completes. Users are advised to check for updates immediately through the browser's About section.
Dell Fixes 70 Vulnerabilities in VSI for VMware vSphere Including Two Critical Flaws
Dell has released an update addressing 70 vulnerabilities in Dell Virtual Storage Integrator for VMware vSphere Client, two of which are product-specific and rated critical. The advisory published on August 6, 2026, covers both native issues and flaws inherited from third-party components. CVE-2026-67261 allows unauthenticated remote attackers to execute arbitrary OS commands with root privileges via the IAPI component. CVE-2026-54489 enables session hijacking by exposing active session credentials without authentication. The product integrates Dell storage arrays with VMware vSphere environments and is widely used in enterprise virtualization deployments. Administrators are urged to apply the latest version immediately to mitigate the risks of full system compromise and unauthorized administrative access.
Top 10 Security Stories: WordPress XSS Flaw, PHP Vulnerabilities, and VMware ESX Issues Lead Weekly Roundup
Security NEXT has published its weekly ranking of the most viewed articles for the period from August 2 to August 8, 2026. The list highlights critical vulnerabilities affecting widely used platforms including WordPress, PHP, pgAdmin 4, VMware ESX, and Chrome. Several entries focus on newly released security updates and ongoing exploitation warnings issued by US authorities. The ranking also includes real-world incidents such as credit card skimming by employees and data leaks caused by phishing attacks. This weekly overview reflects the topics that drew the highest attention from the Japanese cybersecurity community during the specified week.