Ядреная веб-бомба. Разбираем RCE в WordPress без плагинов

Security researchers have published a technical breakdown of a core WordPress vulnerability that allows remote code execution without relying on any third-party plugins — reportedly the first such direct exploitation path found in a decade. The flaw, tracked as CVE-2026-63030, lives in the REST API's batch-processing endpoint (/wp-json/batch/v1), where an attacker can craft a malformed request that desynchronizes the internal $validation and $matches arrays used to check and run queued API calls. By shifting the index alignment between these arrays, a request that failed validation can still be matched to and executed via a legitimate callback, effectively bypassing the intended security checks. A full proof-of-concept and test environment, including a Docker-based lab and a backdoor-style user-creation exploit, is already available in a public GitHub repository, raising urgency for site administrators to apply vendor patches as they become available.