WordPress CVE-2026-63030

Exploitation requires the target to be running an affected WordPress core version (6.9.0-6.9.4 or 7.0.0-7.0.1) with the REST API enabled and the /batch/v1 batch endpoint reachable - both are on by default in a stock WordPress installation. The full impact chain also depends on the site being vulnerable to CVE-2026-60137 (the author__not_in WP_Query SQL injection), so a site that has patched only one of the two CVEs limits the RCE outcome. No authentication or user interaction is required per the CVSS vector (PR:N/UI:N), and no non-default configuration is needed, which is what makes this broadly exploitable; the primary limiting factor is simply whether the site has already applied the 6.9.5 / 7.0.2 update.

This is a genuine high-priority issue rather than an inflated CVSS score. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) indicates unauthenticated, network-reachable exploitation with full confidentiality, integrity and availability impact, and the CISA SSVC assessment reinforces this with Automatable: yes and Technical Impact: total. Publicly available exploit code (a Nuclei template) lowers the barrier to opportunistic scanning and mass exploitation. The one mitigating signal is SSVC Exploitation: none and the absence of a CISA KEV listing, meaning no confirmed active exploitation has been observed yet, so current risk is 'weaponizable and easily automated' rather than 'confirmed in the wild.' One caution: the CVSS vector rates AC:L and PR:N, but real-world exploitation depends on chaining two distinct vulnerabilities (the route confusion plus CVE-2026-60137), so environments that have already addressed the WP_Query SQLi path may be harder to fully exploit than the raw 9.8 suggests - verify both CVEs are remediated.

An unauthenticated attacker sends a crafted request to the WordPress REST API batch endpoint that exploits the route confusion to smuggle a malicious author__not_in parameter into a WP_Query-backed sub-request, triggering the CVE-2026-60137 SQL injection. The injected query is leveraged to read or modify database contents and pivot to remote code execution on the server. A public Nuclei template already exists to detect and exercise the flaw, making automated, at-scale scanning realistic.