CVE-2026-63030: WordPress REST API route confusion and SQL injection leading to RCE

CVE-2026-63030 · Severity: critical · CVSS 7.5 · Exploited in the wild · Published 2026-07-17

WordPress, the world's most popular website management platform, is affected by a critical security flaw in its core software. This vulnerability allows attackers to bypass security controls by confusing how the system processes web requests, potentially leading to the theft of sensitive database information or full control over the website. Because this flaw is reportedly being exploited in the wild, organizations should update their WordPress installations to versions 6.9.5 or 7.0.2 immediately to prevent unauthorized access and data breaches.

Technologies: Wordpress. Vendors: Wordpress.

Quick answers

Is CVE-2026-63030 exploited in the wild?
Yes. CVE-2026-63030 is known to be exploited in the wild, first recorded on 21 July 2026. Treat it as urgent.
How severe is CVE-2026-63030?
Critical severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
Wordpress 6.9.0 - 6.9.4, 7.0.0 - 7.0.1; WordPress Core 6.9.x before 6.9.5, 7.0.x before 7.0.2.
Is there a fix for CVE-2026-63030?
A patch was published on 2026-07-21: Fixes released in WordPress 6.9.5 and 7.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63030 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63030?
Check whether you run Wordpress or WordPress Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

WordPress Core is vulnerable to an interpretation conflict (CWE-436) within its REST API batch endpoint. The flaw stems from route confusion that allows an attacker to bypass intended security constraints. When chained with a separate SQL injection vulnerability in the 'author__not_in' parameter of WP_Query, an unauthenticated remote attacker can execute arbitrary SQL commands. This chain can ultimately be leveraged to achieve Remote Code Execution (RCE) on the underlying server. The vulnerability is addressed in WordPress versions 6.9.5 and 7.0.2.

Affected products

  • WordPress WordPress Core 6.9.x before 6.9.5, 7.0.x before 7.0.2

Timeline

  • 2026-07-17: advisory: Initial NVD publication and CISA-ADP enrichment
  • 2026-07-21: disclosed: Public disclosure date
  • 2026-07-21: exploited: Reported as exploited in the wild in the advisory summary
  • 2026-07-21: patched: Fixes released in WordPress 6.9.5 and 7.0.2

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.