REST API batch endpoint route confusion in WordPress (CVE-2026-63030)

CVE-2026-63030 is a route confusion flaw in the WordPress REST API batch endpoint (/wp-json/batch/v1) that causes two parallel tracking arrays to fall out of step when a sub-request errors, allowing a subsequent request to execute under a different request's handler and bypass the endpoint's allow-list. When chained with the WP_Query author__not_in SQL injection (CVE-2026-60137), the combination permits an unauthenticated, anonymous attacker to achieve remote code execution on a default WordPress installation with no preconditions. The code-execution path is constrained to sites not running a persistent object cache; sites using Redis or Memcached as a persistent object cache may not be reachable via this specific chain, though this is not a fix. Public POC available. Affected versions: - 6.9.0 through 6.9.4 - 7.0.0 through 7.0.1 We recommend updating to: 6.9.5, 7.0.2. CVSS 9.8 · our assessment: act_now Reference: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html Details: https://vuln.today/cve/CVE-2026-63030