Critical Vulnerability in WordPress Core

In today’s Security Sunday, in addition to WordPress, we will look at EY, which reports a leak of client tax data, Microsoft fixed a record 570 bugs, and Cisco Talos uncovered a campaign with trojanized installers of well-known applications.

A critical vulnerability allowing unauthenticated remote code execution (RCE) has been discovered in WordPress core.

The attack, dubbed wp2shell, is so severe that the WordPress[.]org security team released emergency updates on July 17 and took the unusual step of force-pushing the fix to affected sites via the automatic update system.

The flaw was discovered by security researcher Adam Kues of the Assetnote team, part of Searchlight Cyber, who responsibly disclosed it through the HackerOne program.

What makes wp2shell exceptionally dangerous is that it requires no login, no vulnerable plugin, and no special configuration. A completely anonymous attacker can compromise a default WordPress installation with a single HTTP request.

From a technical standpoint, this is not a single bug but a chain of two vulnerabilities. CVE-2026–63030 affects the REST API endpoint (/wp-json/batch/v1), which has been a standard part of WordPress core since version 5.6, released in 2020. Combined with CVE-2026–60137, an SQL injection in database query processing, the chain allows an unauthenticated attacker to escalate from database access all the way to remote code execution — that is, full takeover of the site.

The range of affected versions is fairly specific. The complete RCE chain affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1, as well as the 7.1 beta. The 6.8 branch is affected only by the SQL injection, and versions older than 6.8 are not affected at all, because the vulnerable code was introduced in WordPress 6.9. Fixes are available in WordPress 7.0.2, with backports in versions 6.9.5 (both flaws), 6.8.6 (SQL injection only), and 7.1 beta2.

WordPress, the most widely used CMS, powers an estimated 40% of websites on the internet. A public proof-of-concept for this vulnerability has appeared on GitHub, so I can easily imagine attackers moving fast — the vulnerability may already be under active exploitation. If you haven’t updated yet, I recommend doing so quickly.

Test your system before hackers do!

Every week we bring examples of attacks and vulnerabilities that can affect anyone. If you’re not sure whether your infrastructure is resilient, we’d be glad to help you find out. At SysNetShield we offer vulnerability scanning, penetration testing, Red Teaming, and phishing campaign simulations.

Get in touch — the first consultation or a vulnerability scan of a single domain/IP address is free.

EY Discloses Data Breach

Ernst & Young LLP (EY), one of the “Big Four” consulting firms, has disclosed a security incident involving a third-party IT service management (ITSM) platform used by its IT staff to support teams providing tax services to clients.

Because support tickets submitted through this platform could contain attachments with clients’ tax information, the compromise of a single helpdesk system translated directly into a leak of sensitive client data.

According to EY’s notice, the firm detected anomalous activity on the platform on April 23, 2026, and immediately activated its incident response procedures. The investigation, conducted in cooperation with an independent cybersecurity firm, found that an unauthorized third party had access to the platform between March 28 and April 12, 2026, and downloaded documents relating to a number of EY clients. The attackers thus operated undetected for roughly two weeks, and nearly four weeks passed between the initial intrusion and its discovery.

The compromised documents contained personal and financial information included in or used to prepare tax returns, including data tied to individuals’ investment holdings with EY’s institutional clients. The firm says it has secured the affected systems, confirmed that the unauthorized access has been terminated, and notified federal law enforcement. According to its statement, it currently has no evidence that the stolen data has been misused, nor any indication that the attackers targeted specific individuals.

This is not EY’s first security incident in recent years. In October 2025, researchers discovered a publicly accessible SQL Server backup of roughly 4 TB on Azure cloud storage, linked to EY’s Italian branch. In 2023, the firm was among the victims of the mass exploitation of the MOVEit Transfer vulnerability.

Record July Patch Tuesday: Microsoft Fixes 570 Flaws

Microsoft has released its July 2026 Patch Tuesday updates, addressing a record 570 security vulnerabilities. It is by far the largest monthly batch of fixes in the company’s history, nearly tripling the previous record set just a month earlier.

According to BleepingComputer, the batch includes 59 flaws rated critical, the vast majority of which are remote code execution bugs. Microsoft had warned a week in advance that the number of fixes would rise sharply, as it has begun using an AI-powered vulnerability discovery system designed to find bugs in Windows code before attackers do.

The most urgent items are two zero-day vulnerabilities already being actively exploited. The first, CVE-2026–56155 (CVSS 7.8), is an elevation of privilege flaw in Active Directory Federation Services (AD FS) caused by insufficiently granular access control, allowing an authorized local attacker to gain administrator privileges.

Beyond the zero-days, the batch fixes critical remote code execution flaws in Microsoft Office, SharePoint, SQL Server, Windows DHCP Server, Hyper-V, Windows Media Foundation, and the Remote Desktop client, among others.

Russian-Speaking Actor UAT-11795 Trojanizes WebEx and Zoom

A financially motivated, Russian-speaking threat actor tracked by Cisco Talos as UAT-11795 is trojanizing installers of popular software to steal credentials and cryptocurrency from victims in the United States and Europe.

According to research published by Cisco Talos on July 16, the campaign has been running since at least June 2025. Telemetry data shows infections concentrated in the US, with smaller clusters of victims also observed in Germany, Romania, and Venezuela.

The attackers weaponize trojanized installers of legitimate applications, including MobaXterm, Cisco WebEx, Zoom, DBeaver, and FACEIT.

Although the researchers could not conclusively confirm the initial infection vector, they believe the malicious files are likely delivered via the ClickFix social engineering technique, in which the victim is tricked into running a command that quietly downloads and executes a maliciously modified HTA file through the system’s mshta.exe.

This file downloads a trojanized NSIS installer containing a Python environment and a compiled Python loader disguised as a license file (LICENSE.txt). The loader uses XOR to decrypt and launch an embedded Python backdoor that Talos calls Starland RAT.

Once running, Starland RAT first checks whether it is executing in a sandbox environment, then establishes persistence via a scheduled task named PythonLauncher-{random} and a shortcut in the Startup folder, and attempts to elevate its privileges via UAC.

It then performs extensive reconnaissance. It collects the hardware ID, RAM size, processor, operating system, computer name, region, public IP address, and installed antivirus products, along with Active Directory data such as domain controllers and the victim’s domain privileges. The malware takes a screenshot of the desktop and enumerates more than 40 cryptocurrency wallets, both desktop and browser-extension-based, packaging everything into an encrypted JSON payload sent to a command-and-control (C2) server.

Interestingly, if the hard-coded C2 address is unreachable, the RAT queries a smart contract on the Polygon blockchain, which returns an XOR-encrypted backup domain.