critical CVSS 9.8 Actively exploited EPSS 11%

CVE-2026-63030·WordPress vulnerability

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Severity
critical
Software
WordPress
Fixed in
7.0.2
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 11% — in the top 4% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 7.0

Until: 7.0.2

Fixed in: 7.0.2

How to fix this CVE

Immediately upgrade WordPress to version 7.0.2 or later to patch the REST API batch endpoint route confusion vulnerability that can be chained with SQL injection for remote code execution. This is a critical vulnerability actively exploited in the wild and affects WordPress 7.0.x installations. Apply the update through the WordPress admin dashboard or via command line, then verify the installation.

sudo dnf update wordpress

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET /wp-json/wp/v2/batch.*author__not_in=.*OR.*UNION.*SELECT.*|/wp-json/wp/v2/batch.*with.*CAST.*|POST /wp-json/wp/v2/batch.*parameter.*injection

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Implement a WAF rule to block requests to /wp-json/wp/v2/batch endpoints from untrusted sources, and filter POST/GET requests containing SQL keywords (UNION, SELECT, CAST, OR 1=1) in query parameters, especially author__not_in. Alternatively, disable the REST API batch endpoint entirely if not required for your WordPress installation by adding define('WP_DISABLE_REST_API', true) to wp-config.php until you can fully upgrade.

How to check if you are affected

  1. Check WordPress version: Log into the WordPress admin dashboard, navigate to Dashboard → Updates, or run `wp core version` if WP-CLI is installed to confirm your current version
  2. Verify REST API exposure: Test if the batch endpoint is accessible by making a request to `https://yourdomain.com/wp-json/wp/v2/batch` — if it returns data, the endpoint is exposed
  3. Search web server logs for exploitation attempts: Run `grep -i 'batch.*author__not_in' /var/log/apache2/access.log /var/log/nginx/access.log` to detect SQL injection payloads
  4. Confirm patch installation: After upgrading, re-run `wp core version` or check Dashboard → Updates to verify WordPress is now at 7.0.2 or higher

FAQ

What is CVE-2026-63030?

CVE-2026-63030 is a critical vulnerability in WordPress 7.0.x that exploits a misconfigured REST API batch endpoint combined with SQL injection flaws, allowing attackers to execute arbitrary code on the server without authentication.

Is CVE-2026-63030 being actively exploited?

Yes, this vulnerability is listed in the CISA Known Exploited Vulnerabilities catalog and is actively being exploited in real-world attacks targeting WordPress installations.

What versions of WordPress are affected by CVE-2026-63030?

WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are vulnerable; versions 7.0.2 and later have been patched.

How do I check if my server is vulnerable to CVE-2026-63030?

Run `wp core version` to check your WordPress version — if it is 7.0.0, 7.0.1, or 6.9.4 and below, your installation is vulnerable and requires immediate patching.

Does Defensia detect CVE-2026-63030?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If WordPress is installed on a monitored server, CVE-2026-63030 will appear in your dashboard with remediation steps.

Related WordPress CVEs

CVE-2026-87902CVSS 8.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVE-2026-60137CVSS 5.9WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-63030. Free for 1 server.

Get started free