Summary
CVE-2026-63030 is a critical WordPress REST API batch endpoint flaw affecting versions 6.9.0 – 6.9.4 and 7.0.0 – 7.0.1. When chained with CVE-2026-60137, it forms the wp2shell exploit, allowing unauthenticated remote code execution. Active exploitation was observed shortly after disclosure, prompting emergency security updates.
Urgent Actions Required
- Update to WordPress 6.9.5 or 7.0.2 immediately.
- Verify the update was successfully applied.
- If patching is delayed, block /wp-json/batch/v1 (or ?rest_route=/batch/v1) or restrict anonymous REST API access.
- Check for compromise, including unknown admin accounts, malicious plugins, suspicious PHP files, and unusual REST API batch requests.
Which Systems Are Vulnerable to CVE-2026-63030?
Technical Overview
- Vulnerability Type: EST API Batch Route Confusion (CWE-436: Interpretation Conflict)
-
Affected Software/Versions:
- WordPress 6.9.0 - 6.9.4
- WordPress 7.0.0 - 7.0.1
-
CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
- Patch Availability: Yes, available
How Does the CVE-2026-63030 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-63030?
Vulnerability Root Cause:
CVE-2026-63030 is caused by a logic flaw in the WordPress REST API batch endpoint. During batch request processing, validation and request execution can become misaligned, causing requests to be handled by the wrong internal route. This route confusion allows permission checks to be bypassed. While the flaw alone does not lead to remote code execution, it can be chained with CVE-2026-60137, a SQL injection vulnerability, to form the wp2shell exploit chain that enables unauthenticated remote code execution on affected WordPress installations.
How Can You Mitigate CVE-2026-63030?
If immediate patching is delayed or not possible:
- Block /wp-json/batch/v1 (or ?rest_route=/batch/v1) at the WAF.
- Restrict anonymous REST API access.
- Enable WAF protections to block exploit attempts.
- Apply the official WordPress update as soon as possible.
Which Assets and Systems Are at Risk?
-
Asset Types Affected:
- WordPress Core installations running versions 6.9.0 - 6.9.4
- WordPress Core installations running versions 7.0.0 - 7.0.1
- Default WordPress installations without additional plugins
-
Business-Critical Systems at Risk:
- WordPress websites running affected versions
- Internet-facing WordPress installations that have not been updated
- WordPress installations where automatic updates were disabled, unsupported, or unsuccessful
-
Exposure Level:
- Internet-facing WordPress installations running vulnerable versions
- WordPress installations that remain unpatched
- WordPress installations exposing the /wp-json/batch/v1 endpoint
Will Patching CVE-2026-63030 Cause Downtime?
Patch application impact: Low. Update to WordPress 6.9.5 or 7.0.2. Verify the update completed successfully.
How Can You Detect CVE-2026-63030 Exploitation?
Exploitation Signatures:
- Unusual requests targeting the /wp-json/batch/v1 endpoint or ?rest_route=/batch/v1
- HTTP access logs showing anomalous REST API batch endpoint requests
- High-volume scanning or repeated exploitation attempts against vulnerable WordPress sites
Indicators of Compromise (IOCs/IOAs):
- Newly created administrator accounts
- Unknown or malicious WordPress plugins
- Suspicious PHP files or uploaded web shells
- Attempts to install remote access tools, such as Overlord RAT
- User enumeration activity targeting administrator usernames and email addresses
Behavioral Indicators:
- Upload of malicious plugins after successful exploitation
- Access to the WordPress admin panel using unauthorized administrator accounts
- Local File Inclusion (LFI) activity targeting database credentials and authentication keys
- File management or database access performed through uploaded web shells
Alerting Strategy:
- Priority: Critical
-
Trigger alerts for:
- Requests to the /wp-json/batch/v1 endpoint from untrusted sources
- Creation of new administrator accounts
- Installation of new or unauthorized WordPress plugins
- Suspicious PHP file uploads or web shell activity
See How Fidelis Elevate® Helps Stop Threats Before They Spread
-
-
- Discover the capabilities of an Open and Active XDR platform
- Learn how unified network, endpoint, deception, and AD protection improves detection
- See how proactive threat detection accelerates incident response
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.8 | Indicates a critical vulnerability with severe potential impact |
| Attack Vector | Network | Can be exploited remotely over the network |
| Attack Complexity | Low | No special conditions are required for exploitation |
| Privileges Required | None | The attack does not require authentication |
| User Interaction | None | No user action is needed to trigger the vulnerability |
| Scope | Unchanged | The impact remains within the vulnerable WordPress component |
| Confidentiality Impact | High | An attacker can gain access to sensitive information |
| Integrity Impact | High | An attacker can modify data or system components |
| Availability Impact | High | Successful exploitation can severely affect service availability |
References:
