CVE-2026-63030: WordPress REST API route confusion leads to SQL injection and RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection leading to RCE in widely deployed WordPress core, with KEV listing and near-maximum EPSS.

What it is

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contain a REST API batch endpoint route confusion flaw (CWE-436). Chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), it lets an unauthenticated attacker inject SQL and reach remote code execution. It matters because WordPress core is widely deployed and the flaw is trivially reachable over the network with no credentials or user interaction.

Impact

An attacker can execute arbitrary SQL against the site database and escalate to remote code execution on the server. That yields full compromise of confidentiality, integrity and availability of the WordPress instance and its data.

Attack surface

Reached over the network through the WordPress REST API batch endpoint; the CVSS vector shows no privileges required and no user interaction. Any internet-exposed WordPress 6.9.x or 7.0.x instance below the fixed versions is in scope.

Exploitation

CVE-2026-63030 was added to CISA KEV on 2026-07-21 with a 2026-07-24 remediation due date, indicating known exploitation. EPSS is 0.97271 (99.892nd percentile), and references include a vendor advisory and release notes; no ransomware campaign use is documented.

What to do

• Upgrade WordPress core to 6.9.5 or 7.0.2 (or later) immediately; this is the only complete fix.
• If patching cannot be done at once, restrict or block access to the REST API batch endpoint at the WAF or reverse proxy.
• Apply the CISA KEV required actions and BOD 26-04 guidance, including considering discontinuing use of exposed instances if mitigations are unavailable.
• Audit for prior compromise (webshells, unexpected admin users, modified core files) before returning systems to service.
• Verify the companion fix for CVE-2026-60137 is present, since the chain depends on it.

Detection

• Monitor web logs for POST requests to the REST API batch endpoint with unusual or malformed route payloads.
• Alert on SQL error strings or unexpected query patterns in database and application logs.
• Hunt for new PHP files, modified core files, or unexpected scheduled tasks and admin accounts on WordPress hosts.
• Correlate outbound connections from the web server to unfamiliar hosts, which may indicate post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.