CVE-2026-63030
Description
CVE-2026-63030 is a critical RCE vulnerability in WordPress Core (9.8 CVSS) actively exploited in the wild. Update to 6.9.5 or 7.0.2 immediately.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| wordpress | 6.9 | 6.9.5 | vulnerable |
| wordpress | 7.0 | 7.0.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately apply the security updates provided by WordPress. This vulnerability is addressed in WordPress versions 6.9.5 and 7.0.2. Refer to the official WordPress security release notes for deployment instructions.
Update affected systems
Identify all WordPress installations running versions 6.9.x (up to 6.9.4) and 7.0.x (up to 7.0.1). Ensure these systems are upgraded to version 6.9.5 or 7.0.2 respectively to eliminate the vulnerable REST API batch endpoint logic.
Restrict access
If patching cannot be performed immediately, consider using a Web Application Firewall (WAF) to block or rate-limit requests to the `/wp-json/batch/v1` REST API endpoint. Restricting access to the REST API to trusted IP addresses can also mitigate risk.
Monitor for exploitation
Audit web server access logs for suspicious POST requests targeting the REST API batch routes. Monitor database logs for SQL injection patterns involving the 'author__not_in' parameter and check for the creation of unexpected PHP files in the wp-content directory.
Detection Guidance
"To detect potential exploitation of CVE-2026-63030, monitor web server logs for high volumes of POST requests to `/wp-json/batch/v1` with malformed JSON structures. Specifically, look for payloads attempting to leverage the `author__not_in` parameter for SQL injection. Security teams should also deploy network signatures to identify RCE attempts and perform integrity checks on WordPress core files to identify unauthorized modifications or the deployment of web shells."