A critical security vulnerability has been disclosed affecting several widely used versions of WordPress. If your business website runs WordPress, you need to take action immediately.
This vulnerability — tracked as CVE-2026-63030 — is particularly serious because it can be exploited remotely against a default WordPress installation without requiring any additional plugins. That means even a standard, out-of-the-box WordPress site could be targeted.
More information here
Which versions are affected?
The vulnerability affects the following WordPress versions:
| WordPress Version | Affected versions | Fixed version |
|---|---|---|
| 6.8 | 6.8.0 through 6.8.5 | 6.8.6 |
| 6.9 | 6.9.0 through 6.9.4 | 6.9.5 |
| 7.0 | 7.0.0 through 7.0.1 | 7.0.2 |
| 7.1 Beta | All beta versions prior to 7.1 Beta 2 | 7.1 Beta 2 |
Versions 6.8.0 through 6.8.5 are also vulnerable to SQL injection attacks through a similar exploit path — so this is not just a single issue, it is a broader exposure across the 6.8 series.
What should you do?
If your website is running any of the affected versions, the most important step is to update WordPress to the fixed version as soon as possible.
Before you update, make sure you have a full backup of your website. If something goes wrong during the update, a backup means you can restore quickly without losing any data or content.
If you are unsure what version of WordPress your website is running, or if you are not confident making updates yourself, contact us and we will take care of it for you.
Why does this matter for your business?
A vulnerability like this — one that can be exploited remotely without any special setup — is exactly the kind of thing that attackers scan for automatically. Once the full technical details are publicly released, malicious actors will begin targeting unpatched sites at scale.
The consequences of a compromised website can include:
- Your website being defaced or taken offline
- Customer data being stolen
- Your site being used to distribute malware to your visitors
- Damage to your business reputation and SEO rankings
- Potential legal obligations under Australian privacy law if customer data is exposed
Not sure if your site is affected?
If Warringah IT manages your WordPress website, we are already checking your installations and will be in touch if action is needed. If you manage your own site and are unsure, check your WordPress dashboard — the current version is displayed in the bottom right corner of the admin panel.
If you need help updating WordPress or want us to take over the management of your website security, get in touch with us today. We offer WordPress updates, backups, and ongoing website security monitoring for Northern Beaches businesses.