Liquid Web incident

WP2Shell Wordpress Core Critical Remote Code Execution Vulnerabilities, CVE-2026-60137 and CVE-2026-63030

Critical Resolved View vendor source →

Liquid Web experienced a critical incident on July 20, 2026, lasting 3d 8h. The incident has been resolved; the full update timeline is below.

Started
Jul 20, 2026, 11:43 AM UTC
Resolved
Jul 23, 2026, 07:47 PM UTC
Duration
3d 8h
Detected by Pingoru
Jul 20, 2026, 11:43 AM UTC

Update timeline

  1. investigating Jul 18, 2026, 01:48 AM UTC

    On July 17th Wordpress.org announced two critical remote code execution (RCE) vulnerabilities commonly known as WP2Shell. These vulnerabilities exist in Wordpress Core and allow an unauthenticated request to execute arbitrary code on the target website. Customers running the Wordpress versions below are strongly advised to upgrade to latest version shown as soon as possible: Wordpress 6.8.x; fixed in 6.8.6 WordPress 6.9.x; fixed in 6.9.5 WordPress 7.0.x; fixed in 7.0.2 WordPress 7.1 beta, fixed in 7.1 beta2 Source: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ Posted 2 minutes ago. Jul 17, 2026 - 21:44 EDT

  2. identified Jul 18, 2026, 11:15 PM UTC

    Our teams continue to work diligently to assess the impact of the recently disclosed WordPress Core vulnerabilities and verify that appropriate mitigation measures are in place. We remain actively engaged in our investigation and are monitoring the situation for any new developments. We will continue to closely monitor the situation and take any additional steps necessary to maintain system security and stability. If you need assistance or have any concerns, please contact our Support team.

  3. monitoring Jul 20, 2026, 11:43 AM UTC

    Services have been restored, and websites are currently loading as expected. Our Network team is continuing to investigate the underlying cause and is actively monitoring the environment to ensure stability. At this time, all services appear to be operating normally. If you experience any issues or need assistance, please contact our Support team.

  4. identified Jul 20, 2026, 11:47 AM UTC

    The issue has been identified and a fix is being implemented.

  5. identified Jul 20, 2026, 11:48 AM UTC

    We are continuing to work on a fix for this issue.

  6. identified Jul 20, 2026, 08:20 PM UTC

    Given the severity of this vulnerability, Liquid Web Systems Engineers have been proactively upgrading affected Wordpress applications across our fleet. Customers are still strongly encouraged to review their Wordpress websites and, if affected, to update to the patched version as soon as possible.

  7. resolved Jul 23, 2026, 07:47 PM UTC

    This incident has been resolved.