Critical incident

Nexcess Server: WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030

Affected: Wordpress Core Updates

Current status of Nexcess Server: Operational — live Nexcess Server status

Timeline

1. Jul 18, 2026, 01:44 UTC
   investigating
   On July 17th Wordpress.org announced two critical remote code execution (RCE) vulnerabilities commonly known as WP2Shell. These vulnerabilities exist in Wordpress Core and allow an unauthenticated request to execute arbitrary code on the target website. Customers running the Wordpress versions below are strongly advised to upgrade to latest version shown as soon as possible: Wordpress 6.8.x; fixed in 6.8.6 WordPress 6.9.x; fixed in 6.9.5 WordPress 7.0.x; fixed in 7.0.2 WordPress 7.1 beta, fixed in 7.1 beta2 Source: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
2. Jul 18, 2026, 23:17 UTC
   identified
   Our teams continue to work diligently to assess the impact of the recently disclosed WordPress Core vulnerabilities and verify that appropriate mitigation measures are in place. We remain actively engaged in our investigation and are monitoring the situation for any new developments. We will continue to closely monitor the situation and take any additional steps necessary to maintain system security and stability. If you need assistance or have any concerns, please contact our Support team.
3. Jul 20, 2026, 20:36 UTC
   monitoring
   The Nexcess Managed Wordpress platform configures Wordpress Core updates by default and the vast majority of websites have been updated. Nexcess System Engineers proactively attempted to update affected websites that were not already on the patched version. In some cases this was not possible to do. The Nexcess Managed Wordpress Development team has pushed a must-use plugin that mitigates this vulnerability where the application is not on a patched version. All customers are strongly encouraged to ensure their websites have been updated to the latest version of Wordpress.
4. Jul 23, 2026, 19:45 UTC
   resolved
   This incident has been resolved.

Updates as published by Nexcess Server (original).