Attackers pummel critical WordPress vuln to create all sorts of mischief

WordPress patched two vulnerabilities—CVE-2026-63030 (critical REST API route confusion) and CVE-2026-60137 (moderate SQL injection)—that can be chained to allow unauthenticated RCE; public proof-of-concept code and AI-assisted reproduction led to rapid, widespread exploitation with tens of thousands of attempts, creation of backdoor admin accounts, fake malicious plugins, credential exfiltration, and deployment of additional tooling including the Overlord RAT. Administrators are urged to apply fixes immediately and inspect installations for new admin accounts, malicious plugins, or other indicators of compromise.