JETPACK Critical Threat

We’d like to clarify the situation.

To be clear: we never released the plugin versions mentioned (1.6.9 / 2.10.9 / 1.9.20) as official Pro builds. If you have files with those exact version numbers, they did not come from us — please don’t treat them as a genuine Supsystic release.
What to check on your own site:

1. Open the plugin’s main PHP file and check theVersion:line in the header. If it matches 1.6.9 / 2.10.9 / 1.9.20, delete the plugin folder entirely and reinstall a fresh copy from your licensed download link — don’t just update over it.
2. CheckUsers → All Usersin wp-admin for any account you don’t recognize, especially usernamesstarting with wp_.
3. Update WordPress core, themes, and all plugins to their latest versions.
4. Ask your host to run a malware scan on the account and remove anything flagged.
5. Change your WordPress admin, hosting, and database passwords.

Our currently distributed Pro versions (1.7.0 / 2.11.1 / 1.10.1) do not contain this issue. If you’re unsure which file you’re running or want us to look at your site directly, please open a support ticket and we’ll help you check it.

Separate, critical issue: “wp2shell” — WordPress Core vulnerability (not related to our plugins)
Independently of the above, there is a critical unauthenticated remote code execution vulnerability in WordPress core itself, publicly disclosed and actively exploited. If you’re cleaning up your site anyway, check this too — it can lead to full site takeover on its own, regardless of which plugins you run.
Details:

• CVE-2026-63030— authentication/validation bypass in the REST API batch endpoint (/wp-json/batch/v1), triggered via a///path prefix trick
• CVE-2026-60137— SQL injection in the post query layer, via theauthor__not_inparameter
• Combined, these two chain intounauthenticated RCE—CVSS 9.8 (critical)
• Affected WordPress versions:6.9.0–6.9.4 and 7.0.0–7.0.1
• Fixed in:6.9.5 (if you’re on the 6.9 branch) or 7.0.2 (if you’re on the 7.0 branch)
• Not affected:6.8.5 and earlier
• Disclosed 2026-07-17, added to CISA’s Known Exploited Vulnerabilities list 2026-07-21, public exploit code released 2026-07-22 — but real-world attacks were already happening before the exploit code was public, so treat this as urgent even if you patched “recently.”

How attackers use it (so you know what to look for):

1. Send a request to/wp-json/batch/v1with a manipulated path to bypass validation.
2. Use the SQL injection to pull your database credentials.
3. Create a rogue administrator account — look for a username starting withw2s_.
4. Use that admin account to upload amalicious plugin or a PHP web shell.

What to do, step by step:

1. Check your WordPress version(Dashboard → Updates, orSettings → Generalshows it at the bottom, or checkwp-includes/version.php). If it’s 6.9.0–6.9.4 or 7.0.0–7.0.1, this applies to you.
2. Update WordPress core immediatelyto 6.9.5 or 7.0.2, whichever matches your branch. Do this before anything else below — if you’re still on a vulnerable version, an attacker can re-compromise you again while you clean up.
3. If you can’t patch right away, ask your host or firewall/CDN provider to block anonymous requests to/wp-json/batch/v1as a temporary stopgap. This is not a fix, just a delay.
4. Go to Users → All Usersand look for any admin account with a username starting withw2s_. If you find one, delete it immediately and check the site’s activity/audit log (if you have one) for what that account did — new plugins installed, files edited, etc.
5. Check wp-content/plugins/ for any plugin folder you don’t recognizeand didn’t install yourself. Attackers commonly install a plugin to keep a web shell.
6. Search for unfamiliar PHP filesanywhere inwp-content/, especially inuploads/(which normally shouldn’t contain.phpfiles at all).
7. After cleanup, rotate all credentials— WordPress admin passwords, database password, FTP/SFTP, hosting panel — since the attack chain exposes database credentials directly.
8. Have your host run a malware scanover the whole account, not just this one site, if you host multiple sites on shared hosting — the same server could be affected elsewhere.

This is a WordPress core issue, not something any plugin update can fix on its own — the only real fix is updating core to 6.9.5/7.0.2.