{"id":"CVE-2026-63030","aliases":["BIT-wordpress-2026-63030","BIT-wordpress-multisite-2026-63030","DEBIAN-CVE-2026-63030","EUVD-2026-45280","GHSA-ff9f-jf42-662q","UBUNTU-CVE-2026-63030"],"status":"published","title":"WordPress \u003c 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.10649,"percentile":0.95857,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-436"],"published":"2026-07-17T19:14:12Z","modified":"2026-11-08T02:47:39Z","kev":{"date_added":"2026-07-21","due_date":"2026-07-24","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-07-21"},{"source":"kev","since":"2026-07-21"}],"exploits":[{"source":"pocgithub","id":"Icex0/wp2shell-poc","title":"Icex0/wp2shell-poc","date":"2026-07-17","url":"https://github.com/Icex0/wp2shell-poc"},{"source":"pocgithub","id":"ZephrFish/wp2shell-scanner","title":"ZephrFish/wp2shell-scanner","date":"2026-07-17","url":"https://github.com/ZephrFish/wp2shell-scanner"},{"source":"pocgithub","id":"attackercan/wp2shell-poc2","title":"attackercan/wp2shell-poc2","date":"2026-07-17","url":"https://github.com/attackercan/wp2shell-poc2"},{"source":"metasploit","id":"exploit/multi/http/wp_batch_desync_rce","title":"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","type":"exploit","platform":"Linux,PHP,Unix","date":"2026-07-17","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_batch_desync_rce"},{"source":"pocgithub","id":"0xWhoknows/wp2shell","title":"0xWhoknows/wp2shell","date":"2026-07-18","url":"https://github.com/0xWhoknows/wp2shell"},{"source":"pocgithub","id":"0xsha/wp2shell","title":"0xsha/wp2shell","date":"2026-07-18","url":"https://github.com/0xsha/wp2shell"},{"source":"pocgithub","id":"47Cid/wp2shell-lab","title":"47Cid/wp2shell-lab","date":"2026-07-18","url":"https://github.com/47Cid/wp2shell-lab"},{"source":"pocgithub","id":"4minx/CVE-2026-63030","title":"4minx/CVE-2026-63030","date":"2026-07-18","url":"https://github.com/4minx/CVE-2026-63030"},{"source":"pocgithub","id":"ChiefYoru/CVE-2026-63030_PoC","title":"ChiefYoru/CVE-2026-63030_PoC","date":"2026-07-18","url":"https://github.com/ChiefYoru/CVE-2026-63030_PoC"},{"source":"pocgithub","id":"CybersecSpirit/CVE-2026-63030","title":"CybersecSpirit/CVE-2026-63030","date":"2026-07-18","url":"https://github.com/CybersecSpirit/CVE-2026-63030"},{"source":"pocgithub","id":"J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t","title":"J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t","date":"2026-07-18","url":"https://github.com/J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t"},{"source":"pocgithub","id":"NULL200OK/WP2Shell","title":"NULL200OK/WP2Shell","date":"2026-07-18","url":"https://github.com/NULL200OK/WP2Shell"},{"source":"pocgithub","id":"Senanfurkan/wordpress-cve-2026-63030","title":"Senanfurkan/wordpress-cve-2026-63030","date":"2026-07-18","url":"https://github.com/Senanfurkan/wordpress-cve-2026-63030"},{"source":"pocgithub","id":"ashrafzaryouh/CVE-2026-63030","title":"ashrafzaryouh/CVE-2026-63030","date":"2026-07-18","url":"https://github.com/ashrafzaryouh/CVE-2026-63030"},{"source":"pocgithub","id":"dinosn/wp2shell-lab","title":"dinosn/wp2shell-lab","date":"2026-07-18","url":"https://github.com/dinosn/wp2shell-lab"},{"source":"pocgithub","id":"ekomsSavior/wp2shell","title":"ekomsSavior/wp2shell","date":"2026-07-18","url":"https://github.com/ekomsSavior/wp2shell"},{"source":"pocgithub","id":"fullhunt/wp2shell-scan","title":"fullhunt/wp2shell-scan","date":"2026-07-18","url":"https://github.com/fullhunt/wp2shell-scan"},{"source":"pocgithub","id":"gbrsh/CVE-2026-63030","title":"gbrsh/CVE-2026-63030","date":"2026-07-18","url":"https://github.com/gbrsh/CVE-2026-63030"},{"source":"pocgithub","id":"kulichr/wp2shell","title":"kulichr/wp2shell","date":"2026-07-18","url":"https://github.com/kulichr/wp2shell"},{"source":"pocgithub","id":"mrx-arafat/CVE-2026-63030-POC","title":"mrx-arafat/CVE-2026-63030-POC","date":"2026-07-18","url":"https://github.com/mrx-arafat/CVE-2026-63030-POC"},{"source":"pocgithub","id":"mverschu/CVE-2026-63030","title":"mverschu/CVE-2026-63030","date":"2026-07-18","url":"https://github.com/mverschu/CVE-2026-63030"},{"source":"pocgithub","id":"own2pwn-fr/wp2shell-detect","title":"own2pwn-fr/wp2shell-detect","date":"2026-07-18","url":"https://github.com/own2pwn-fr/wp2shell-detect"},{"source":"pocgithub","id":"securelayer7/WordPresShell","title":"securelayer7/WordPresShell","date":"2026-07-18","url":"https://github.com/securelayer7/WordPresShell"},{"source":"pocgithub","id":"tcyph3r/wp2shell-cve-2026-63030-root-cause","title":"tcyph3r/wp2shell-cve-2026-63030-root-cause","date":"2026-07-18","url":"https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause"},{"source":"pocgithub","id":"zi3lak/wp2shell_scanner","title":"zi3lak/wp2shell_scanner","date":"2026-07-18","url":"https://github.com/zi3lak/wp2shell_scanner"},{"source":"pocgithub","id":"0xh7ml/CVE-2026-63030","title":"0xh7ml/CVE-2026-63030","date":"2026-07-19","url":"https://github.com/0xh7ml/CVE-2026-63030"},{"source":"metasploit","id":"auxiliary/scanner/http/wordpress_wp2shell_sqli","title":"WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion","type":"auxiliary","date":"2026-07-17","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli"},{"source":"nuclei","id":"CVE-2026-63030","title":"WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml"}],"exploits_more":51,"fixes":[{"ecosystem":"Bitnami","package":"wordpress","fixed_in":["6.9.5","7.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"wordpress-multisite","fixed_in":["6.9.5","7.0.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["7.0.2+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"wordpress","ranges":[{"type":"SEMVER","events":[{"introduced":"6.9.0"},{"fixed":"6.9.5"},{"introduced":"7.0.0"},{"fixed":"7.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"wordpress-multisite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.9.0"},{"fixed":"6.9.5"},{"introduced":"7.0.0"},{"fixed":"7.0.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2+dfsg1-1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"wordpress","product":"core"},{"vendor":"wordpress","product":"wordpress"},{"vendor":"wordpress foundation","product":"wordpress"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","tags":["vdb-entry","technical-description","Vendor Advisory","advisory","report"]},{"url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","tags":["release-notes","vendor-advisory","Release Notes","article","advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63030","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63030.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-63030","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-63030","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","tags":["report"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/85015b84fbc52bf6151a691299896b8971772594","tags":["report"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/c8bdf1fa12355f79db94054d307d0e3898b501c9","tags":["report"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/6f2074dda61864a03f334d70414d1690ce7e5c79","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-63030","title":"WordPress \u003c 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-17T19:14:12.91Z","modified":"2026-10-07T18:26:30.478Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:19:55.914391Z"}],"euvd":[{"id":"EUVD-2026-45280","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-17T19:14:12Z","modified":"2026-10-07T18:26:30Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-07-21","updated_at":"2026-11-02T17:27:34.353796Z"}],"kev":[{"id":"CVE-2026-63030","title":"WordPress Core Interpretation Conflict Vulnerability","description":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","cwes":["CWE-436"],"kev":{"date_added":"2026-07-21","due_date":"2026-07-24","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-63030","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-17T20:17:28.49Z","modified":"2026-10-08T10:35:50.787Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-436"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-63030","title":"WordPress \u003c 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-17T19:14:12.91Z","modified":"2026-11-08T02:47:39.414016317Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-07T03:08:08.50782Z"},{"id":"DEBIAN-CVE-2026-63030","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-17T20:17:28.49Z","modified":"2026-10-09T09:47:32.904170768Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-63030","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-17T20:17:00Z","modified":"2026-10-17T13:00:31.443768601Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:43.630667Z"},{"id":"BIT-wordpress-2026-63030","title":"WordPress \u003c 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-27T05:55:54.872Z","modified":"2026-11-07T02:56:04.919117443Z","updated_at":"2026-11-07T03:05:28.577678Z"},{"id":"BIT-wordpress-multisite-2026-63030","title":"WordPress \u003c 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution","description":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","status":"published","published":"2026-07-27T05:55:58.991Z","modified":"2026-11-07T02:56:04.919117443Z","updated_at":"2026-11-07T03:05:28.577678Z"}]}}