WordPress Plugin Security Roundup: July 2026

Every month we review the WordPress vulnerability disclosures from Patchstack, Wordfence Intelligence, and WPScan, then summarize the ones that matter most: high install counts, exploitable without privileges, or actively weaponized in the wild. This series usually focuses on plugins, because plugins are where most WordPress sites get breached. July 2026 was the exception — its biggest disclosure was in WordPress core itself.

July 2026 at a Glance

All four now have fixes available — the miniOrange bypass went several weeks without one, and a patched version has since shipped. The core flaw is the one that reset the threat landscape for the month: an unauthenticated attacker running code on a default WordPress install, no plugins required. We start there.

wp2shell — WordPress Core Remote Code Execution (Critical)

CVEs: CVE-2026-63030 (REST API batch-route confusion, Critical) chained with CVE-2026-60137 (SQL injection in WP_Query; scored 5.9 by WPScan and 9.1 by the WordPress security team, so treat the rating as disputed)
Affected versions: WordPress 6.8 through 7.0.1 (the full chain hits 6.9.0–7.0.1)
Fixed in: 7.0.2, 6.9.5, and 6.8.6 (released July 17, 2026)
Auth required to exploit: None — fully unauthenticated
Affected installs: Every WordPress site on a vulnerable version — a default install with zero plugins is exploitable

This is not a plugin bug. It is the first critical, unauthenticated remote code execution vulnerability in WordPress core in nearly a decade, and it is now listed in CISA's Known Exploited Vulnerabilities catalog. The batch-route confusion was reported by Adam Kues at Assetnote / Searchlight Cyber, the SQL injection it chains with by the team of TF1T, dtro, and haongo; together the pair got nicknamed "wp2shell." On July 17 the core team shipped emergency releases and, in their words, enabled forced updates via the auto-update system because of the severity. If your site auto-updates core, it was very likely patched for you within hours. If you disabled core auto-updates, you are the target audience for the rest of this section.

The exploit is a two-stage chain. CVE-2026-63030 is a route/handler confusion in the REST API's batch endpoint: an index desynchronization lets an attacker unbind input validation from execution, so unvalidated data reaches a place it never should. That data feeds CVE-2026-60137, a SQL injection reachable through WP_Query. On its own the SQL injection is a serious data-exposure bug. Combined with the batch-route confusion, it becomes a path an anonymous request can walk from "read the database" to "run code on the server."

Exploitation started fast. Patchstack documented the first exploit attempts roughly ninety minutes after the update landed; Wordfence recorded REST API probing on July 17 followed by a clear SQL-injection attempt thirteen minutes later. Working proof-of-concept code appeared publicly over the following days, then Wiz, Rapid7, and Qualys all reported mass scanning in the wild — with tens of thousands of attempts blocked inside the first week. A vulnerability that turns any unpatched WordPress site into a shell is exactly the kind that gets weaponized at internet scale, which is what happened here.

What to do:

• Confirm your core version is 7.0.2, 6.9.5, or 6.8.6 (Dashboard → Updates, or the footer of the admin screen). Anything below is live.
• If auto-updates are off, update core now — this is not a "next maintenance window" job.
• Assume any site that sat unpatched after July 18 may have been probed. Review your admin user list, look for unfamiliar accounts or files in the web root, then scan for web shells.
• If you cannot update immediately, a web application firewall rule from Wordfence or Patchstack blocks the known attack path as a stopgap — but patching is the fix.

CVE-2026-57807 — miniOrange OAuth SSO (CVSS 9.8 Critical)

Affected versions: OAuth Single Sign On – SSO (OAuth Client) up to and including 38.5.8
Fixed in: 38.5.8.1 (the plugin's WordPress.org listing shipped a security release on July 29)
Auth required to exploit: None — fully unauthenticated
Install count: Small — a niche SSO plugin, not a mass-market one

This plugin has a small footprint, so why lead the plugin section with it? Because for most of July it combined the two worst properties a vulnerability can have: a 9.8 unauthenticated takeover, and no patch to apply. Reported by researcher Kim Dvash in June and published by Patchstack on July 9, 2026, CVE-2026-57807 is an authentication bypass classed as CWE-288 — authentication bypass using an alternate path or channel.

The flaw lives in the plugin's password-recovery flow. That flow is an alternate authentication path that never re-enforces the login checks the normal path does. An attacker abuses it to assume any user identity — including an administrator — without a password, without an account, without any interaction from the site owner. The end state is a full site takeover from an anonymous request.

A fix now exists — Patchstack directs users to version 38.5.8.1 or later, and the plugin's WordPress.org listing shipped its own security release on July 29. But this one sat exposed for roughly three weeks between publication and a patch, and Patchstack flagged it as a high-priority flaw expected to feed mass-exploit campaigns. Treat any site that was running it during that window as potentially reached. What to do:

• Update immediately. Get to 38.5.8.1 or later — or the latest version your installation offers, since miniOrange's version numbering differs between its distributions.
• If you cannot update, deactivate and delete. If single sign-on is not business-critical, removing the plugin is the clean fix.
• Virtual-patch as a stopgap. Patchstack and Wordfence block this at the firewall while the plugin stays active.
• Audit for damage regardless. Review your administrator accounts for logins or additions you did not make. The exposure window was open for weeks, so patching now does not tell you whether someone already walked through.

The lesson generalizes past this one plugin. Install count measures how many sites are affected, never how dangerous the bug is. A 9.8 unauthenticated takeover on a few thousand sites is a worse day for each of those owners than a medium-severity flaw on a million.

CVE-2026-15005 — Loco Translate (CVSS 8.8 High)

Affected versions: All versions up to and including 2.8.5
Fixed in: 2.8.6 (current release is 2.8.7)
Auth required to exploit: None on the attacker's side — the attack tricks a logged-in administrator
Install count: ~1,000,000 active installs

Loco Translate lets you edit theme and plugin translations from inside WordPress. It runs on more than a million sites. Wordfence disclosed CVE-2026-15005 in mid-July: a cross-site request forgery flaw in the plugin's template handling that escalates all the way to PHP code execution on the server.

The root cause is missing nonce validation on the execTemplate function. Without that check, the plugin cannot tell a genuine admin request from a forged one. An attacker crafts a malicious link, gets a logged-in administrator to click it — a targeted email or a comment is enough — then the forged request supplies a php://filter stream wrapper as the template parameter. That wrapper is passed straight to an include, which defeats the path validation and executes attacker-controlled PHP.

CSRF needs a logged-in victim, so it is a rung below the two unauthenticated flaws above. It is not theoretical, though — administrators click links every day, plus the payload here is full code execution, not a nuisance. The fix is clean: update Loco Translate to 2.8.7 (the patch landed in 2.8.6). After updating, if you want extra assurance, review the plugin's template directory for files you do not recognize.

The Three-Step Response

1. Patch WordPress core first. Confirm you are on 7.0.2, 6.9.5, or 6.8.6. This is the highest-priority item on the list because it needs no plugin, no account, and it is being exploited at scale right now.
2. Deal with the plugins. Update Loco Translate to 2.8.7. Update miniOrange OAuth SSO to 38.5.8.1 or later — and because that one went weeks without a fix, check your admin accounts even after patching.
3. Do the post-patch cleanup. For anything that sat unpatched during the exposure window, review your administrator list, scan for unexpected files, then rotate credentials if there is any sign of compromise. Updating closes the door; it does not undo a break-in that already happened.

If you manage several WordPress sites, running this by hand for each one is slow. Patchstack and WPScan both offer free tiers that email you when a vulnerability is disclosed for a plugin on your connected sites. Our free Vortex Security Check plugin scans your installed plugins, themes, plus core against the same databases without your data ever leaving the site.

Looking Ahead

July broke the usual pattern of this roundup, but the underlying lessons are the same ones we write down every month. wp2shell proves that "it's just core, core is safe" is a dangerous assumption — the platform itself gets exploited — and when it does, auto-updates separate a patched site from a shelled one. The miniOrange bypass proves that a small install count is not safety. And the Loco Translate flaw is the familiar reminder that a missing nonce check can turn one admin click into code execution.

The through-line is speed. wp2shell went from disclosure to in-the-wild exploitation in roughly ninety minutes, which means the gap between "a patch exists" and "you applied it" is the entire attack surface. If keeping up with core and plugin disclosures every month is not realistic for your business, our managed WordPress hosting monitors these feeds, applies the patches fast, then verifies the fix held — so a month like July is our fire drill instead of yours. We will publish the August 2026 roundup at the end of next month. Until then, the Patchstack database is updated daily, free to search.

Related reading: WordPress Vulnerability Tracker • Free WordPress Vulnerability Scanner • How to Check if Your WordPress Plugins Have Security Vulnerabilities • WordPress Security Checklist for Small Business Sites • Managed WordPress Hosting Plans