Breach Watch: WordPress Core wp2shell RCE Hits CISA KEV, Craneware Confirms Healthcare Data Theft
The goal of this briefing is to give 100 percent practical value to CISOs and CISO teams. It separates confirmed facts from unverified claims and links the sources we checked.
Two items dominated the day. First, a pre-authentication remote code execution chain in WordPress Core, tracked as wp2shell (CVE-2026-63030 and CVE-2026-60137), was added to the CISA Known Exploited Vulnerabilities catalog on July 21 after multiple firms confirmed exploitation in the wild. This is core WordPress, not a plugin, so a default install with no add-ons is exposed. Inventory and verify patch state now; do not assume forced auto-update completed.
Second, Craneware, a financial and billing software provider used by roughly 2,000 US hospitals and health systems, confirmed attackers exfiltrated data including some employee records and a subset of customer and partner records. If you use Craneware or its Trisus products, treat this as a third-party risk event and open your vendor incident process.
1. WordPress Core wp2shell: pre-auth RCE chain added to CISA KEV
| Affected product | WordPress Core 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 (full RCE chain); 6.8.0 to 6.8.5 exposed to the SQL injection alone |
| CVEs | CVE-2026-63030 (REST API batch-route confusion, CVSS 9.8 per WPScan CNA) and CVE-2026-60137 (WP_Query author__not_in SQL injection) |
| Disclosed | July 17, 2026 |
| Added to CISA KEV | July 21, 2026 |
| Status | Active exploitation confirmed by multiple firms; public proof-of-concept exploits circulating. No public IoCs or attribution as of July 20. |
| Fixed in | WordPress 7.0.2, 6.9.5, and 6.8.6 |
What happened
WordPress released security updates on July 17, 2026, for two Core vulnerabilities that can be chained for pre-authentication remote code execution. CVE-2026-63030 is a REST API batch-route confusion weakness introduced in WordPress 6.9. CVE-2026-60137 is a SQL injection flaw in the author__not_in parameter of WP_Query. Chained on 6.9.0 through 7.0.1, an unauthenticated attacker can reach the batch endpoint at /wp-json/batch/v1 and run code on the server. An anonymous user can execute the chain against a default install with no plugins required.
CVE-2026-63030 was reported by Adam Kues of Searchlight Cyber, who held back technical specifics on disclosure day given the severity. CVE-2026-60137 was reported by researchers TF1T, dtro, and haongo. Public proof-of-concept exploits appeared on GitHub within hours of disclosure, aided by AI-assisted patch diffing. CISA added the chain to its Known Exploited Vulnerabilities catalog on July 21. Tenable notes that all four prior WordPress entries in the KEV catalog were plugin flaws; pre-auth RCE in Core itself is uncommon.
Evidence
Verified against two independent sources:
- Tenable Research Special Operations, wp2shell FAQ (July 20, 2026): tenable.com
- NetSPI executive blog, WordPress Core pre-auth RCE overview (July 20, 2026): netspi.com
What this means for your team
Inventory every WordPress instance, including staging and development sites, and confirm the running version directly rather than trusting that forced auto-update applied. Flag any 6.9.0 to 6.9.4 or 7.0.0 to 7.0.1 instance as immediately exposed to the full RCE chain, and 6.8.0 to 6.8.5 as exposed to the SQL injection. Patch to 7.0.2, 6.9.5, or 6.8.6. If patching is delayed, block both batch API paths at the WAF (/wp-json/batch/v1 and /?rest_route=/batch/v1); blocking only one leaves the other open. Review logs for POST requests to those routes with SQL-like strings in author_exclude or author__not_in, and check for new admin accounts and unexpected PHP files in wp-content. Because no official IoCs exist yet, treat any unpatched internet-facing instance as potentially compromised until verified.
2. Craneware confirms data theft affecting US healthcare customers
| Organization | Craneware, healthcare finance and billing software (UK HQ in Scotland, US HQ in Florida) |
| Footprint | Software used by roughly 2,000 US hospitals and health systems, plus clinics and pharmacies; flagship product Trisus Chargemaster |
| Disclosed | July 20, 2026, via a notice to the London Stock Exchange; reporting continued July 21 |
| Data involved | A significant volume of file names viewed and exfiltrated (largely non-sensitive or public regulatory data, per the company), plus some employee data and a subset of customer and partner records |
| Attribution | None disclosed. The company did not name a threat actor or intrusion method. |
What happened
Craneware disclosed a cybersecurity incident involving unauthorized access to part of its data environment. The company said a significant volume of file names was viewed and exfiltrated, and that a large portion of the accessed data was non-sensitive or already public regulatory information. It also confirmed that some employee data and a subset of customer and partner records were accessed and exfiltrated. Craneware said the incident was contained with no disruption to customer-facing services, and that it notified the UK Information Commissioner's Office and the US Federal Bureau of Investigation. The investigation and affected-party notification are ongoing. Craneware did not attribute the attack or describe how access was obtained.
Evidence
Verified against two independent sources:
- TechCrunch, reporting on the Craneware breach (July 20, 2026): techcrunch.com
- Infosecurity Magazine, Craneware reports data theft (July 21, 2026): infosecurity-magazine.com
What this means for your team
If your organization uses Craneware or Trisus products, activate your third-party incident process now. Ask the vendor in writing what data categories were exfiltrated, whether any records tied to your organization or its patients were involved, and the containment timeline. Watch for notification correspondence and confirm it through a known channel rather than trusting inbound email, since the company noted uncertainty about its own email during the response. This incident continues a run of attacks on healthcare software and billing suppliers, so revisit which vendors hold your patient or billing data and what your contracts require them to disclose and by when.
On the watchlist
These items did not meet our two independent source bar as of publication, or are early and evolving. They are listed without specifics and will be revisited if corroboration firms up.
- Additional July 21 CISA KEV entries. Reporting indicates the same July 21 batch also included a Langflow flaw (CVE-2026-0770) and a DD-WRT flaw (CVE-2021-27137). If you run Langflow or DD-WRT, review those advisories directly and check patch status.
- A reported intrusion at an open-source AI platform involving an autonomous AI agent. Single-source at time of writing; specifics withheld pending corroboration.
- A reported exposure of personal data tied to a national population dataset. Unverified; specifics withheld pending corroboration.
FAQ
What is wp2shell?
wp2shell is the name for a two-vulnerability chain in WordPress Core, CVE-2026-63030 and CVE-2026-60137, that lets an unauthenticated attacker achieve remote code execution on WordPress 6.9.x and 7.0.x installations. Patches are available in WordPress 7.0.2, 6.9.5, and 6.8.6.
Is wp2shell being exploited?
Yes. Multiple security firms confirmed in-the-wild exploitation within days of the July 17, 2026 disclosure, and public proof-of-concept exploits are circulating. CISA added the chain to its Known Exploited Vulnerabilities catalog on July 21, 2026.
Does wp2shell affect plugins or WordPress itself?
WordPress Core itself. A default installation with no plugins is exposed if it runs an affected version, which makes inventory and patch verification the priority.
What data did the Craneware breach involve?
Craneware said a significant volume of file names was exfiltrated, largely non-sensitive or public regulatory data, along with some employee data and a subset of customer and partner records. The company has not attributed the attack or detailed the intrusion method.
Why does the Craneware breach matter to CISOs outside healthcare?
It is a third-party and supply-chain risk case. Software vendors that sit at the center of an industry hold data for thousands of downstream organizations, so a single vendor incident can expose many customers at once. The lesson applies to any sector that depends on concentrated software suppliers.
What should we do first?
Patch or mitigate wp2shell across all WordPress instances and verify the running version directly. For Craneware, open your vendor incident process and confirm in writing what data was affected.
Methodology: This briefing covers items disclosed or reported on the prior US Eastern calendar day (July 21, 2026), with reporting and advisories dated July 20 to 21. Each featured item is corroborated by at least two independent sources that we fetched and confirmed. Vendor and threat-actor claims are labeled as such and separated from confirmed facts. Numbers are reported as stated by the sources and are not rounded or estimated.
Corrections and takedown requests: CISO Platform is committed to accuracy and fairness. If any detail in this briefing is inaccurate, or if you represent an affected organization and would like a correction or removal, please contact us at pritha.aash@cisoplatform.com and we will review your request promptly.
Comments