Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-63030 9.8
WordPress · Core · Added 2026-07-21 · Published 2026-07-17
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityWordPress Core Interpretation Conflict Vulnerability
VendorWordPress
ProductCore
Date added2026-07-21
Due date2026-07-24
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-436
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Descriptions

KEV: WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

NVD: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-08-25 19:48 UTC
Wall time0.5s
Searches2
Component defaultyes
Sources https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/
https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/
https://www.picussecurity.com/resource/blog/cve-2026-63030-and-cve-2026-60137-wp2shell-wordpress-rce-explained
https://nvd.nist.gov/vuln/detail/CVE-2026-63030
https://github.com/mverschu/CVE-2026-63030
https://github.com/Lutfifakee-Project/wp2shell
https://github.com/NULL200OK/WP2Shell
https://github.com/joaovicdev/EXPLOIT-CVE-2026-63030
https://github.com/ikow/wp2shell

Hunting hypothesis agent

Hunt access logs for POST to /wp-json/batch/v1 containing nested JSON with "http://:" path primers and author_exclude SQL injection patterns (SLEEP, ASCII, SUBSTRING), then plugin uploads to /wp-admin/update.php.

Research details

ComponentREST API batch endpoint (/wp-json/batch/v1) route validation — double-nested batch payload causes $matches/$validation desync
PreconditionsNetwork reachability to the affected interface or service — no authentication barrier; Target must run a vulnerable version of Core; No persistent object cache must be in use (per Cloudflare) agent
DeliveryNetwork (HTTP/HTTPS); unauthenticated POST to /wp-json/batch/v1 with double-nested batch payloads using "http://:" path desync primer, triggering route confusion that routes the inner request through WP_Query's author__not_in parameter for SQL injection, enabling oEmbed cache writes, changeset elevation, admin creation, plugin upload, and reverse shell.
Public PoCyes
PoC URLs https://github.com/NULL200OK/WP2Shell
https://github.com/ikow/wp2shell
https://github.com/mverschu/CVE-2026-63030
https://github.com/Lutfifakee-Project/wp2shell
https://github.com/joaovicdev/EXPLOIT-CVE-2026-63030 Third-party repos; verify before use.
Advisoryhttps://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core/
Exploit notesFully weaponized public PoC (wp2shell, 15 stars, 5 forks). Complete exploitation pipeline: time-based blind SQLi via batch route confusion, UNION row-forgery for oEmbed cache writes, changeset elevation to create administrator, one-shot plugin upload with passthru reverse shell. No authentication or plugins required on stock WordPress 6.9.0-6.9.4 or 7.0.0-7.0.1. CVSS attack complexity: LOW | CRITICAL severity (CVSS 9.8).
SummaryWordPress Core 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contains a REST API batch endpoint route confusion vulnerability (CWE-436, CVE-2026-63030) that, when chained with the author__not_in SQL injection in CVE-2026-60137, enables unauthenticated Remote Code Execution on default installations without plugins. The exploitation chain uses a double-nested batch payload with an "http://:" path primer to desync $matches routing, inject SQL via the author_exclude parameter, forge UNION rows for oEmbed cache writes, elevate via changeset re-entry to create an administrator, and upload a one-shot plugin webshell for reverse shell access. Multiple fully weaponized public PoCs exist (wp2shell, 15+ stars).

Tia coverage

First reported2026-07-18
First exploit report2026-07-20
Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

north-korea-infects-thousands-of-devices-worldwide-through-faketiktouk-wordpress-toolkit-could-enable-aws-smtp-and-api-credentiwp2shell-cisa-adds-to-kev-wiz-details-webshell-installation-at-s

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub