The PHP security team released fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two critical flaws. Site owners need their host to install the PHP security update, since updating WordPress does not patch PHP.
A critical XSS2Shell vulnerability, tracked as CVE-2026-64638, was recently discovered in WordPress Core, allowing remote code execution from a single failed login attempt. This flaw affected nearly all actively maintained WordPress installations, putting over 500 million sites at risk. WordPress released an emergency fix in version 7.0.3 on August 6, 2026, urging all administrators to update immediately.
Critical wp2shell vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, are now under active exploitation on WordPress sites. These flaws enable unauthenticated remote code execution, making immediate updates to WordPress 6.9.5 or 7.0.2 essential. The rapid weaponization highlights a shrinking window for administrators to apply necessary security patches.
Hexa Tiger 
Scale My Publication 
SEO for Public Figures