What is the CVSS score of CVE-2026-63030?

CVE-2026-63030 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 8.9%.

Which versions of WordPress are affected by CVE-2026-63030?

WordPress versions 6.9.0 through 7.0.1 contain a critical remote code execution vulnerability (CVE-2026-63030, CVSS 9.8) with publicly available exploit code.. A patch is available.

Is there a public PoC exploit available for CVE-2026-63030?

Yes, a public proof-of-concept exploit is available for CVE-2026-63030. Prioritise patching immediately. EPSS: 8.9%.

How to fix or mitigate CVE-2026-63030?

Within 24 hours, audit all WordPress installations to identify instances running versions 6.9.0-6.9.4 or 7.0.0-7.0.1, prioritizing internet-facing systems. Within 7 days, upgrade all affected installations to version 6.9.5 (for 6.9.x) or version 7.0.2 (for 7.0.x), and verify upgrades completed across all systems. Within 30 days, review WordPress access logs and REST API activity for suspicious batch endpoint requests and conduct forensic analysis of any previously vulnerable systems for indicators of prior exploitation.

WordPress CVE-2026-63030

EUVD-2026-45280 CRITICAL

Interpretation Conflict (CWE-436)

2026-07-17 WPScan

WordPress RCE SQLi

9.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

CRITICAL

qualitative

vuln.today AI

9.8 CRITICAL

Unauthenticated network attack against the default REST batch endpoint with SSVC-confirmed automatability justifies AV:N/AC:L/PR:N/UI:N; SQLi-to-RCE yields full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 21, 2026 - 19:03 CISA

Analysis Updated

Jul 18, 2026 - 05:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 18, 2026 - 05:22 vuln.today

cvss_changed

Severity Changed

Jul 18, 2026 - 05:22 NVD

HIGH CRITICAL

CVSS changed

Jul 18, 2026 - 05:22 NVD

7.5 (HIGH) 9.8 (CRITICAL)

Analysis Generated

Jul 17, 2026 - 21:51 vuln.today

Patch available

Jul 17, 2026 - 21:03 EUVD

CVSS changed

Jul 17, 2026 - 20:22 NVD

7.5 (HIGH)

CVE Published

Jul 17, 2026 - 19:14 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 17, 2026 - 19:14 cve.org

HIGH 7.5

DescriptionCVE.org

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Articles & Coverage 4

elastic.co WordPress Pre-Auth RCE Chain wp2shell (CVE-2026-63030, CVE-2026-60137): Detection and IOCs Jul 23, 2026 wiz.io CVE-2026-63030 & CVE-2026-60137: wp2shell Pre-Auth RCE Chain Actively Exploited in WordPress Core Jul 20, 2026 POC WordPress REST Batch Route Confusion Enables Pre-Auth SQLi-to-RCE Chain (CVE-2026-63030, CVE-2026-60137) Jul 20, 2026 News Critical RCE in WordPress 6.9.x/7.0.x via REST API & SQL Injection - CVE-2026-63030 Jul 18, 2026

AnalysisAI

Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint route confusion flaw that, when chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), lets attackers inject SQL and ultimately execute arbitrary code on the underlying host. Publicly available exploit code exists (a ProjectDiscovery Nuclei template and WPScan advisory), and the CISA SSVC framework rates the flaw as automatable with total technical impact, though it is not currently listed in CISA KEV. The vulnerability was reported by WPScan and patched in the WordPress 7.0.2 and 6.9.5 releases.

Technical ContextAI

The affected component is WordPress core's REST API infrastructure, specifically the batch (/batch/v1) endpoint that dispatches multiple sub-requests in a single call. The root cause is CWE-436 (Interpretation Conflict / route confusion): the batch dispatcher and the underlying route-matching logic disagree on how a request path or parameter is resolved, allowing a request to be routed or validated inconsistently. This route confusion becomes dangerous when it is used to reach or smuggle input into WP_Query's author__not_in handling, which contains the separate SQL injection tracked as CVE-2026-60137. Because WP_Query builds SQL from the author__not_in array, unsanitized values flow into the database query, and a successful SQLi against a MySQL/MariaDB backend can be escalated to remote code execution (for example via option or plugin manipulation and PHP object handling paths). The CPE cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* confirms WordPress core itself is the affected product rather than a third-party plugin.

RemediationAI

Vendor-released patch: upgrade WordPress to 7.0.2 (for the 7.0.x branch) or 6.9.5 (for the 6.9.x branch); sites with automatic background minor updates enabled will typically receive the release automatically, but this should be verified. Because the flaw is exploited by chaining with CVE-2026-60137, confirm the upgrade also remediates that SQL injection. Where immediate patching is not possible, restrict or filter access to the REST API batch endpoint (/wp-json/batch/v1) at the WAF or reverse-proxy layer and block anomalous author__not_in query parameters, accepting the trade-off that disabling batch requests may break plugins or clients that rely on batched REST calls. Refer to the vendor advisory at https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q and the release announcement at https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ (additional analysis at https://vuldb.com/vuln/379927).