CVE-2026-63030 -- CVSS 9.8 Vulnerability Briefing
CVE-2026-63030 | CVSS 9.8 (Critical) | Exploit: PoC available
What Is It
CVE-2026-63030 is a chained vulnerability affecting WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2, in which a REST API batch endpoint route confusion flaw can be combined with a separate SQL injection vulnerability (CVE-2026-60137) to achieve unauthenticated SQL injection and remote code execution against the WordPress core platform.
Technical Detail
The primary flaw involves route confusion in the WordPress REST API batch processing endpoint, which can be abused to misdirect requests in a way that invokes the vulnerable author__not_in parameter handling in WP_Query, the subject of CVE-2026-60137. The author__not_in parameter fails to properly sanitize attacker-controlled input before incorporating it into a SQL query, enabling injection into the underlying database. When chained, these two flaws allow an attacker to extract sensitive data from the database and, under conditions where file write permissions or plugin/theme execution paths are accessible, escalate to remote code execution on the host server.
Exploitation Status
A proof-of-concept exploit is publicly available as of this writing. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and there is no confirmed evidence of active in-the-wild exploitation at this time. However, the public availability of a PoC for a critical-severity WordPress vulnerability significantly lowers the barrier for opportunistic exploitation, and exploitation attempts should be anticipated in the near term.
Who Is Targeting This
No specific threat actor attribution at this time. Neither confirmed nor reported threat actor associations have been established for this vulnerability as of July 20, 2026.
What To Do
Update WordPress to version 6.9.5 or 7.0.2 immediately, depending on the branch in use. Given the critical CVSS score of 9.8 and the availability of a public PoC, patching should be treated as urgent and prioritized ahead of routine maintenance windows. Organizations unable to patch immediately should consider disabling or restricting access to the REST API batch endpoint at the web application firewall or reverse proxy layer as a temporary mitigation. Web application firewall rules targeting SQL injection patterns in REST API request bodies may provide partial detection coverage. Monitor web server and database logs for anomalous REST API batch requests, unexpected SQL errors, or unusual outbound connections from the web server process, which may indicate exploitation attempts or post-exploitation activity.