CVE-2026-63030: WordPress REST API RCE Vulnerability

CVE-2026-63030 Overview

CVE-2026-63030 is a critical route confusion vulnerability in the WordPress REST API batch endpoint. The flaw affects WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2. When chained with the author__not_inWP_Query SQL injection tracked as CVE-2026-60137, unauthenticated attackers can execute arbitrary SQL and achieve remote code execution on the underlying host. The issue is classified under [CWE-436] Interpretation Conflict. CISA has added CVE-2026-63030 to the Known Exploited Vulnerabilities catalog, confirming active exploitation against internet-facing WordPress sites.

Critical Impact
Unauthenticated attackers can chain the REST API route confusion with a known SQL injection to execute arbitrary code and fully compromise WordPress sites.

Affected Products

WordPress 6.9.x prior to 6.9.5
WordPress 7.0.x prior to 7.0.2
Self-hosted and managed WordPress deployments exposing the REST API

Discovery Timeline

2026-07-17 - CVE-2026-63030 published to the National Vulnerability Database
2026-07-22 - Entry last modified in NVD
2026-07-24 - EPSS score recorded at 97.923% (99.904 percentile)

Technical Details for CVE-2026-63030

Vulnerability Analysis

The vulnerability resides in how the WordPress REST API /batch/v1 endpoint parses and dispatches nested route requests. The batch handler and the individual route handlers interpret the same request differently, producing an interpretation conflict [CWE-436]. Attackers can craft a batch payload that the outer router treats as authorized or benign, while the inner route resolves to a sensitive query path such as /wp/v2/users with attacker-controlled parameters. When paired with CVE-2026-60137, the author__not_in parameter reaches WP_Query without proper sanitization, enabling SQL injection. From SQL injection, attackers pivot to remote code execution by writing PHP payloads through database-backed options or by extracting authentication material.

Root Cause

The root cause is inconsistent request normalization between the batch controller and downstream route handlers. The batch endpoint validates the wrapper request, then reissues sub-requests without re-applying the parameter and permission checks the underlying route expects. This trust boundary gap lets the second-stage SQL injection reach WP_Query unfiltered.

Attack Vector

Exploitation requires only network access to the WordPress REST API. No authentication or user interaction is needed. An attacker submits a crafted POST request to /wp-json/batch/v1 referencing a vulnerable route with a malicious author__not_in array. The response leaks query results or triggers writes that lead to code execution.

No public proof-of-concept code has been verified for inclusion. See the WordPress GitHub Security Advisory for the vendor's technical description.

Detection Methods for CVE-2026-63030

Indicators of Compromise

POST requests to /wp-json/batch/v1 containing nested author__not_in parameters or SQL metacharacters
Unexpected new administrator accounts or modifications to the wp_options table entries such as active_plugins
New or modified PHP files in wp-content/uploads/ or the active theme directory
Outbound connections from the web server to unfamiliar hosts following REST API traffic

Detection Strategies

Inspect web server and application logs for HTTP requests to /wp-json/batch/v1 with array-style author__not_in[] values
Deploy WAF signatures that flag SQL keywords such as UNION, SLEEP, or INFORMATION_SCHEMA inside REST API bodies
Correlate REST API requests with subsequent database errors or unusually long query execution times

Monitoring Recommendations

Enable WordPress debug logging and forward wp-content/debug.log to a central log platform for review
Monitor file integrity across wp-content/, wp-admin/, and wp-includes/ for unauthorized changes
Alert on creation of privileged users and on modifications to wp_users and wp_usermeta outside change windows

How to Mitigate CVE-2026-63030

Immediate Actions Required

Upgrade to WordPress 6.9.5 or 7.0.2, which contain the vendor-supplied fix
Rotate all administrator passwords, application passwords, and secret keys defined in wp-config.php after patching
Review recent database and file system changes for signs of prior exploitation, given the CISA KEV listing

Patch Information

WordPress released fixed builds on the 7.0.2 release announcement. The GitHub Security Advisory GHSA-ff9f-jf42-662q documents the fix, which enforces consistent parameter validation and permission checks across the batch controller and its sub-routes. Sites configured for automatic background updates should receive the patch without operator intervention, but administrators must verify the installed version.

Workarounds

Restrict access to /wp-json/batch/v1 at the reverse proxy or WAF layer until the patch is applied
Disable or rate-limit the REST API for unauthenticated clients using a trusted security plugin
Block requests containing author__not_in in REST API bodies where legitimate integrations do not require it

bash

# Example NGINX block for the batch endpoint pending patching
location = /wp-json/batch/v1 {
    deny all;
    return 403;
}