CVE-2026-63030

Published Jul 17, 2026

Last updated a month ago

Exploit known CVSS critical 9.8

WordPress

web application

Zero-day

Open source

SQL injection

wp2shell

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-63030 is an unauthenticated remote code execution (RCE) vulnerability affecting WordPress versions 6.9 and later. This flaw allows an attacker to execute arbitrary code through the batch endpoint of the REST API. Exploitation of CVE-2026-63030 does not require any user interaction or authentication, and it is specifically possible when a persistent object cache is not in use. The vulnerability is related to a REST API batch-route confusion and SQL injection issue. Fixes for this vulnerability have been released in WordPress 7.0.2 and 6.9.5.

Description: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Source: contact@wpscan.com
NVD status: Analyzed
Products: wordpress

Insights

Analysis from the Intruder Security Team

Published Jul 17, 2026 Updated Jul 21, 2026

This is one of two vulnerabilities in a combined chain that allows remote code execution on any stock WordPress installation. CVE-2026-63030 is the entry point — a route confusion bug in the REST API batch endpoint that bypasses authentication, allowing an attacker to invoke internal handlers without any permission check. When combined with CVE-2026-60137, the attacker gains the ability to read any data from the WordPress database with a single HTTP request. An exploit chain has been demonstrated which combines both of these bugs to achieve code execution.

WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1 are affected. Update to WordPress 6.9.5 or 7.0.2 immediately. No plugins, user interaction, or non-default configuration is required to exploit. Given WordPress powers approximately 43% of all websites, the attack surface is enormous.

WordPress Core contains a pre-authentication route confusion vulnerability in the REST API batch endpoint that, combined with CVE-2026-60137, allows remote code execution.

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: WordPress Core Interpretation Conflict Vulnerability
Exploit added on: Jul 21, 2026
Exploit action due: Jul 24, 2026
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-436

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D5B37C71-893E-460E-8790-88EF786DF56E",
            "versionEndExcluding": "6.9.5",
            "versionStartIncluding": "6.9",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "02352A0A-26C7-4ABC-83F6-8493C6A3FB5C",
            "versionEndExcluding": "7.0.2",
            "versionStartIncluding": "7.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.