🔴 CVE-2026-63030

CVE-2026-63030 is a critical unauthenticated remote code execution vulnerability in WordPress core, caused by a REST API batch endpoint route confusion issue that, when chained with a WP_Query SQL injection (CVE-2026-60137), grants full server compromise. WordPress is the most widely deployed CMS on the internet and is almost universally internet-facing, making this a textbook T1190 with active in-the-wild exploitation and CISA KEV listing.

← Back to Overview
HIGH_RISK
Risk Level
9.8
CVSS Score
NETWORK
Attack Vector
Initial Access
ATT&CK Tactic
T1190 — Exploit Public-Facing Application
ATT&CK Technique
VERY_HIGH
Deployment Risk
No
Ransomware

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-17

Added to CISA KEV: 2026-07-21 4 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-63030 is a critical logic vulnerability within the WordPress REST API batch processor (`/wp-json/batch/v1`) that involves a route confusion issue [2]. When chained with a separate SQL injection vulnerability in `WP_Query` (CVE-2026-60137), it allows unauthenticated attackers to achieve remote code execution (RCE) on affected WordPress installations [3][4]. This vulnerability is highly significant because it enables full site compromise without requiring any user credentials or interaction [1].

Exploitation

  • Active Exploitation: The vulnerability is actively exploited in the wild, with mass scanning campaigns observed shortly after the disclosure of the "wp2shell" exploit chain [1][7].
  • Availability: Public proof-of-concept (PoC) exploits and exploit tools are readily available on platforms like GitHub, facilitating widespread exploitation [1][3].
  • Attack Prerequisites:
- Authentication: None required (unauthenticated) [3]. - Access: Network-based exploitation via the public-facing REST API [2]. - User Interaction: None required [1].

Affected Products & Patches

  • Affected Versions: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 [5].
  • Patch Availability: Fixed in WordPress versions 6.9.5 and 7.0.2 [5].
  • Mitigations: Security researchers recommend upgrading to the patched versions immediately as the primary mitigation [6]. In the absence of an immediate update, temporary WAF rules filtering malicious REST API batch requests may provide partial protection.

Impact

  • Capability: Successful exploitation grants an attacker full remote code execution, effectively allowing them to take total control over the compromised WordPress installation.
  • Business Risk: Internet-facing WordPress deployments are at extreme risk of full site takeover, including unauthorized data access, content manipulation, malware distribution, and further lateral movement within the hosting environment.

Sources

  1. WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning

    Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites. The two security flaws, tracked as CVE-2026-63030 and CVE-2026-60137, have been codenamed wp2shel…

  2. CVE-2026-63030: wp2shell a Critical Remote Code Execution ... - Rapid7

    On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. ... CVE-2026-63030 is a logic flaw in the WordPress REST API batch processor (/wp-json/batch/v1). The batch API performs validation…

  3. 0xsha/wp2shell: CVE-2026-63030 - GitHub

    CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core REST API batch route confusion (CVE-2026-63030) chained with a WP_Query author__not_in SQL injection (CVE-2026-60137) → pre-auth remote code execution against a default WordPress install.

  4. NVD-CVE-2026-63030

    CVE-2026-63030 Detail Description WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Co…

  5. NVD-CVE-2026-63030 - National Vulnerability Database

    Description. WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined ...

Generated by PatchNow Intelligence System

Analysis based on CIRCL.LU data, Claude AI assessment, and MITRE ATT&CK framework

📄 Download JSON Data | 📡 RSS Feed