Both wp2shell CVEs land on CISA KEV — federal clock runs

CISA added both wp2shell CVEs — the WordPress Core RCE (CVE-2026-63030) and its SQL injection companion (CVE-2026-60137) — to the Known Exploited Vulnerabilities catalog on July 21. The federal patch clock under BOD 26-04 is running.

Two things about this KEV pair matter beyond the usual “government-timestamped exploitation” milestone.

The SQLi is on KEV. CVE-2026-60137 scores CVSS 5.9 at NVD. KEV entries are almost always high or critical items with directly observed exploitation. CISA’s own KEV summary on this one reads: the flaw “can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.” That’s a walkback on the initial framing — Rapid7’s Emergent Threat Response post and the companion CVE landing writeup from July 20 both treated the two as distinct primitives, with 60137 as plugin-mediated and not directly extending to code execution. CISA is now saying the chain is a default-install RCE. If you triaged 60137 as medium and left it, revisit.

BOD 26-04, not the old 21-day flat. BOD 26-04 replaced the flat KEV remediation deadline with risk-based timelines earlier this year. Federal civilian executive branch agencies patch on the schedule CISA sets per entry — read the directive text and the implementation guidance if you’re in scope. Everyone else gets the same message a different way: government has now formally confirmed exploitation of a WordPress core RCE with a public PoC. If you were waiting for that shoe to drop before scheduling downtime, it dropped.

What to actually do

• Update WordPress core to 6.8.6, 6.9.5, or 7.0.2, per the wordpress.org 7.0.2 release notes. The 6.8.6 patch matters for the SQLi — 6.8.x was previously considered out of range for the RCE only, not for the SQLi.
• If you cannot patch this week, pull the instance off the public internet. Four vendors — KEVIntel, watchTowr, Wiz, and Cloudflare — have confirmed mass scanning since Tuesday morning. The KEV addition is the government-timestamped floor, not the ceiling.
• Assume compromise on unpatched public instances. If your WordPress site is public-facing and has been on 6.9.x or 7.0.0–7.0.1 at any point since July 17, treat it as compromise-adjacent until IR proves otherwise. CMSmap webshells and backdoor admin accounts have been the observed post-exploitation footprint.

The honest timeline: initial disclosure was July 17. First reports of exploitation, July 20. Mass scanning confirmed, morning of July 21. CISA KEV addition, later July 21. Four days from public advisory to KEV — a normal-fast cadence for a WordPress core RCE with a working public PoC, but it doesn’t help you if you’re reading this on July 22 and your site was compromised on July 18.

Patch first, look for shells second.