CVE-2026-63030

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

Exploited in the wild. In CISA KEV since 2026‑07‑21. Fixed versions are out.

CVSS 3.19.8Critical EPSS percentile96th11% chance in 30 days CISA KEVListedsince 2026-07-21, due 2026-07-24
No public exploit known Fix1 product2 fixed builds listed below

Published 2026-07-17Updated 2026-10-08Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

WordPressAffected: ≥ 6.9.0, < 6.9.5Upgrade to: 6.9.5Affected: ≥ 7.0.0, < 7.0.2Upgrade to: 7.0.2Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Vendor advisory Usually a quick update

Check it yourselfA free Nuclei and OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Discuss checks for your systems with a specialist. Scope is agreed before testing.

Coverage timeline

10 publishers

Exploits are active for CVE-2026-63030, a SQL injection vulnerability in WordPress Core leading to unauthenticated remote code execution.
as reported · Oct 12, 2026·The Hacker News summary
Security researchers analyze a novel WordPress core vulnerability (CVE-2026-63030) enabling RCE without plugins, providing technical details on the exploitation logic.
as reported · Sep 29, 2026·Хакер (xakep.ru) summary
Critical RCE vulnerability CVE-2026-63030 in WordPress Core allows unauthenticated attackers to execute code.
as reported · Aug 6, 2026·Patchstack summary
Advisory coverage
as reported · Jul 23, 2026·Cisco Talos summary
Proof-of-concept published
as reported · Jul 21, 2026·Хакер (xakep.ru) summary
Added to CISA KEV catalog
Jul 21, 2026·CISA KEV

Sourced from public security reporting — each date is when it was published, not when it happened. 4 further articles named this CVE in wider roundups without reporting it as a distinct event.

What it is

From the CVE record

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

In plain language

Written by AI from the record

If you run WordPress versions older than 7.0.2 (or 6.9.5), attackers can reach a REST API and use it to inject database code, potentially taking over your site—this is an active, real-world attack and you should act now.

CVE-2026-63030 is an unauthenticated Remote Code Execution path in WordPress due to a REST API batch-route confusion that can be used to trigger a SQL injection weakness leading to code execution; it has been confirmed exploited in the wild (CISA KEV) and requires urgent patching.

If you're affected

Full website takeover
Webshell installation and persistence
Customer and credential theft
Site defacement or disruption

What is it

This bug is in WordPress’s public REST API—like a “back door” route the site uses for certain requests. Attackers can confuse how the requests are handled, then use that confusion to trick the site into running malicious database instructions, which can escalate into complete control of the site (for example by installing a webshell).

Who is affected

This matters if you run WordPress websites using versions earlier than 7.0.2 (and 6.9.x earlier than 6.9.5), especially if your site is reachable from the internet. The attack does not require a login or user interaction, so scanning and opportunistic attacks can target you without you doing anything. The practical risk is highest when your WordPress site’s REST API is publicly reachable.

How urgent is it

This is a RED issue because it is being actively exploited in the wild, not just discussed or theoretically possible. CISA has included it in KEV with a remediation deadline of 2026-07-24, so delays directly increase the chance of takeover attempts succeeding against internet-facing sites.

What to do — in detail

Confirm exposure

Check your WordPress version:
- In WordPress Admin: go to Dashboard → Updates (or Tools → Site Health / About WordPress) and note the version number.
Determine whether you fall into either affected range:
- WordPress 6.9.x before 6.9.5
- WordPress 7.0.x before 7.0.2

Upgrade remediation (target fix)

Upgrade WordPress to the fixed version for your branch:
- If you’re on 6.9.x, upgrade to 6.9.5.
- If you’re on 7.0.x, upgrade to 7.0.2.
After the upgrade, immediately verify:
- The site still loads normally.
- Your REST API endpoints respond as expected.

Temporary mitigation if patching is delayed

Restrict public access to WordPress REST API endpoints until patched:
- Use your web server rules or a WAF to block or rate-limit calls to REST API routes.
- If your business relies on REST API functionality, block selectively and test carefully.

Post-upgrade incident checks (because exploitation is confirmed)

Inspect your site for signs of compromise:
- Check for unexpected files (commonly webshell-like files placed in theme/plugin/content directories).
- Review installed plugins and themes for anything you did not install or recognize.
- Look for recent changes in file timestamps in wp-content.
If you find suspicious items:
- Remove the malicious plugin/theme/files.
- Rotate any exposed credentials (especially WordPress admin/user passwords and hosting control panel credentials).

KEV timing

CISA KEV remediation due date: 2026-07-24.

What to monitor next

Monitor web access logs for repeated probing/scanning and for unexpected POST/GET requests to REST API endpoints.
Monitor for new admin users and changes to WordPress configuration and database-backed settings.

Technical context

Severity and risk: This is a critical, internet-reachable weakness with a full takeover end goal, reflected by CISA KEV listing and active exploitation. The weakness is described as a REST API batch-route confusion (CWE-436) that can be used without authentication, via network requests, to trigger a SQL injection condition and then achieve Remote Code Execution. Exploitation status: KEV confirms it is actively exploited in the wild; news reports describe mass scanning and attacker behaviors including deploying webshells, installing malicious plugins, and exfiltrating credentials. Patch status: Fixed in WordPress 6.9.5 and 7.0.2. EPSS: a predictive score exists, but KEV/news confirmation takes precedence over prediction for urgency. KEV meaning here: inclusion indicates CISA has high confidence it is being exploited, requiring prioritized remediation across affected assets.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

CISA KEV

Listed as exploited in the wild since 2026-07-21.

US federal agencies must remediate by 2026-07-24.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

11% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

30 events over 83 days, from the signal feeds we watch.

2026-10-08Patch availablerecord updated
2026-10-07Patch availablerecord updated
2026-10-02EPSS band changecritical → moderate
2026-10-01EPSS band changecritical → moderate
2026-09-30EPSS band changecritical → moderate
2026-09-24EPSS band changecritical → moderateepss band change

Affected products

WordPressoss-project · USaka wordpress mu, wp, wordpress.org
- WordPressWeb AppOn-premWeb & CMS Plugins / cms-core

And 1 more affected product. See all after sign-in

Scale

How widely the affected products are used. This is not a count of vulnerable hosts.

Estimate Public sources, each figure dated. How much of it is already patched is not known.

WordPress

Web

Usage: unknown. No public source measures this product yet.

Version split: unknown. No public source for this product.

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable