CVE-2026-63030
WordPress Core Interpretation Conflict Vulnerability
Description
CVE-2026-63030 is a REST API batch endpoint route confusion vulnerability in WordPress core that, combined with the author__not_in WP_Query SQL injection tracked as CVE-2026-60137, allows an attacker to perform SQL injection and achieve remote code execution. The batch endpoint resolves requests to routes in a way that differs from what the surrounding validation assumes, so an unauthenticated request can be steered into a code path that should not have been reachable, and from there the SQL injection primitive becomes exploitable. WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are affected. Rated CVSS 9.8 (Critical) with an EPSS score of 98% — the 99.9th percentile of all CVEs — this WordPress vulnerability is among the most likely to be exploited that CISA currently tracks, and it was added to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-07-24. Any site running an affected version should treat updating as an emergency.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| wordpress | wordpress | >= 6.9, < 6.9.5; >= 7.0, < 7.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
Weakness Type
CWE-436: Interpretation Conflict
CWE-436 describes a weakness in which two or more components interpret the same input differently, so a request that one layer considers safe is processed by another layer in an unintended way. In WordPress the REST API batch endpoint and the route resolution behind it disagree about which route a batched request targets, and that inconsistency lets an attacker reach functionality that the request-level checks were meant to guard, which is what makes the accompanying SQL injection reachable without authentication.
Learn more: CWE-436 — Interpretation Conflict
Impact Analysis
CVE-2026-63030 carries a CVSS 3.1 base score of 9.8 (Critical) with every exploitability metric at the maximum: remotely exploitable without physical access, easy to exploit with no special conditions needed, no authentication needed, and no user action required. Confidentiality (High): the chained SQL injection exposes the entire WordPress database, including user records with password hashes and options rows holding API keys and integration secrets. Integrity (High): the documented outcome of the chain is remote code execution, so an attacker can modify site content, install backdoors, and alter plugin or theme files. Availability (High): code execution on the web host also permits defacement or destruction of the site and its database. The EPSS score of 98% signals near-certain exploitation activity, and combined with the CISA KEV listing this is about as unambiguous as a "patch right now" signal gets. Two factors amplify the business risk: WordPress powers a very large share of public websites, so attacker interest is guaranteed, and the REST API is enabled by default, meaning the vulnerable endpoint is reachable on a standard installation without any special configuration.
Exploit Maturity
CVE-2026-63030 has an EPSS score of 98.4%, placing it in the 99.91st percentile — effectively the top of the exploitation-likelihood scale, which indicates near-certain active exploitation rather than a forecast. CISA has added the CVE to its Known Exploited Vulnerabilities catalog with a due date of 2026-07-24, confirming exploitation in the wild; ransomware use is currently marked as Unknown. No public exploit code is linked in the available references — the sources are the WordPress security advisory GHSA-ff9f-jf42-662q, the WordPress 7.0.2 release notes, and the CISA KEV entry — but the chaining is documented in the CVE description itself: with CVE-2026-60137, the SQL injection in author__not_in, the route confusion becomes an unauthenticated path to remote code execution. Given the size of the WordPress install base and the default-enabled REST API, an unpatched site should be assumed to be scanned continuously and updated within hours, not days.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-07-24.
- Update WordPress core to 6.9.5 or 7.0.2 immediately, as described in GHSA-ff9f-jf42-662q and the WordPress 7.0.2 release announcement. Because the chain also relies on CVE-2026-60137, the same update closes both halves; verify the running version afterwards rather than trusting the auto-update log.
- Where an update cannot be deployed within hours, block or restrict access to the REST API batch endpoint at the web server or WAF layer, and limit REST API access to authenticated contexts, so that unauthenticated requests cannot reach the route-resolution mismatch.
- Treat affected sites as potentially compromised, since exploitation is confirmed and the endpoint leads to code execution: review web server logs for requests to the batch endpoint, compare core, plugin, and theme files against known-good copies, look for new administrator accounts and scheduled tasks, and rotate database credentials, salts, and any API keys stored in the options table.
- As long-term hardening, keep WordPress core on automatic minor updates, minimise the plugin surface that forwards request data into query arguments, place the site behind a WAF that normalises requests before they reach the application, and monitor for the specific pattern of batch API calls followed by unusual database or filesystem activity.
Technical Details
CVE-2026-63030 stems from route confusion at the WordPress REST API batch endpoint: batched sub-requests are matched against registered routes inconsistently with how the enclosing request is validated, an interpretation conflict (CWE-436) between the batching layer and the routing layer. That mismatch means an attacker can construct a batch request whose sub-request reaches a handler that would normally be gated, and NVD's description states that combining this with the author__not_in WP_Query SQL injection of CVE-2026-60137 allows SQL injection and remote code execution. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a network-delivered attack with low complexity, no privileges, and no user interaction, and full High impact on confidentiality, integrity, and availability — the availability and integrity impacts follow from code execution rather than from the injection alone. Scope remains unchanged (S:U) because the compromised component is the WordPress application itself, though code execution on a web host normally extends an attacker's reach to everything that host can access. Affected versions are 6.9 up to but not including 6.9.5, and 7.0 up to but not including 7.0.2.
Frequently Asked Questions
Is CVE-2026-63030 being actively exploited?
Yes. CVE-2026-63030 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-07-24, and its EPSS score of 98.4% ranks it in the 99.9th percentile, indicating near-certain exploitation activity. Ransomware usage is currently marked as Unknown, but the vulnerability is documented as part of a chain that reaches remote code execution.
What products are affected by CVE-2026-63030?
The vulnerability affects WordPress core in versions 6.9 up to but not including 6.9.5, and 7.0 up to but not including 7.0.2. The vulnerable component is the REST API batch endpoint, which is available on a default WordPress installation, and the full impact requires the author__not_in SQL injection of CVE-2026-60137 that the same releases also fix.
How do I fix CVE-2026-63030?
Update WordPress core to 6.9.5 or 7.0.2 without delay, which fixes both the batch endpoint route confusion and the SQL injection it chains with. If an immediate update is impossible, restrict access to the REST API batch endpoint at the web server or WAF level, and afterwards audit the site for new administrator accounts, modified files, and signs of database extraction.
How severe is CVE-2026-63030?
CVE-2026-63030 is rated Critical with a CVSS 3.1 base score of 9.8, reflecting unauthenticated remote exploitation with high impact on confidentiality, integrity, and availability. Its EPSS score of 98.4% is in the 99.9th percentile — among the highest exploitation probabilities assigned to any CVE — and the documented outcome of the chain with CVE-2026-60137 is remote code execution on the web server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.