WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has published a security release including WordPress 7.0.2 on July 17, 2026, to address multiple vulnerabilities that could lead to remote code execution when chained together.
The update resolves two specific issues tracked as CVE-2026-63030 and CVE-2026-60137. Security researchers determined that combining these flaws allows an attacker to execute arbitrary code remotely on vulnerable sites.
CVE-2026-60137 is an input validation weakness affecting certain functions. It can result in SQL injection when the application processes untrusted data supplied by plugins or themes.
CVE-2026-63030 arises from route interpretation confusion within the REST API batch endpoint. When exploited in conjunction with the SQL injection vulnerability, it enables remote code execution.
The CVE-2026-60137 issue affects the 6.8 branch and later, while CVE-2026-63030 exists in the 6.9 branch and later. Chained attacks are not possible on the 6.8 series according to the advisory.
Site administrators are strongly encouraged to update their installations without delay to protect against potential exploitation.
Related articles
Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability in Gitea, tracked as CVE-2026-20896 with a CVSS score of 9.8, allows attackers to gain administrative access and read private repositories by sending a single HTTP header. The root cause lies in the official Docker image defaulting the REVERSE_PROXY_TRUSTED_PROXIES setting to a wildcard, trusting the X-WEBAUTH-USER header from any source when reverse-proxy authentication is enabled. The researcher reproduced the full attack on a live vulnerable instance, demonstrating how an unauthenticated request could retrieve secret files such as .env containing database passwords and cloud keys. Multiple related access-control flaws were also disclosed in the same year, including CVE-2026-27771 affecting the container registry, CVE-2026-22874 in webhooks, and CVE-2026-28740 in LFS handling. The recommended fix involves explicitly setting trusted proxy IPs or disabling reverse-proxy authentication entirely and upgrading to version 1.26.4 or later. The issue highlights recurring problems with overly permissive defaults in self-hosted DevOps tools.
Windows Lacks Official Patch for LegacyHive Zero-Day; 0Patch Delivers Free Micro-Patch
A zero-day vulnerability named LegacyHive has been discovered in the Windows user profile service, allowing any standard user to mount another user's registry hive with full access. The flaw was reported on July 14 by researcher Nightmare Eclipse, coinciding with Microsoft's Patch Tuesday, and enables extraction of stored secrets or persistence by modifying registry settings that execute code on the next administrator login. Microsoft has acknowledged the issue and is investigating, but no official fix has been released yet. ACROS Security stepped in with a free micro-patch through its 0Patch platform that neutralizes the exploit by redirecting it to a harmless temporary hive instead of the administrator profile. The protection is available for Windows 10 version 2004 and later, as well as Windows Server 2022 and newer releases, and requires only registration and agent installation without a reboot. Researchers Will Dormann and Kevin Beaumont have independently confirmed the exploit's functionality, with Beaumont also publishing Microsoft Defender for Endpoint queries to detect related attacks.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has released a new security update for its Chrome browser addressing seven vulnerabilities just two days after the previous patch. The update covers Windows, macOS, and Linux platforms with versions Chrome 150.0.7871.129 and 150.0.7871.128. Three of the issues, tracked as CVE-2026-15899, CVE-2026-15900, and CVE-2026-15901, received the highest severity rating of Critical and involve Use After Free flaws in CameraCapture, GPU, and Network components. Four additional High-severity vulnerabilities were also fixed, including an out-of-bounds access issue in the V8 JavaScript engine and Use After Free problems in Cast, Ozone, and Aura. The company plans to roll out the patches gradually over the coming days and weeks to all users.