WordPress Core Interpretation Conflict Vulnerability (CVE-2026-63030)

What is affected, what to do

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

The vulnerability is being actively exploited; treat it as a priority. Update WordPress to version 6.9.5, WordPress to version 7.0.2. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• WordPress lt 6.9.0..6.9.5
• WordPress lt 7.0.0..7.0.2

Fixed in

• WordPress 6.9.5
• WordPress 7.0.2

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Enumerate every WordPress instance, including marketing microsites, staging, agency-hosted sites and multisite networks. Check the version via wp core version, the generator meta tag or /wp-includes/version.php. Vulnerable: 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
   • Patch: Upgrade to WordPress 6.9.5 or 7.0.2 (wp core update --minor or wp core update --version=7.0.2). Check whether minor background updates have been disabled (WP_AUTO_UPDATE_CORE, automatic_updater_disabled) and re-enable them where appropriate.
   • Close the chain: Confirm in the vendor advisory that the installed release also fixes the chained SQL injection CVE-2026-60137 (author__not_in in WP_Query). The two flaws are exploited together.
   • Interim block until patched: Block unauthenticated access to the REST batch endpoint at the reverse proxy or WAF. This covers /wp-json/batch/v1 and the query-string form ?rest_route=/batch/v1, including URL-encoded variants.
   • Compromise check on exposed, unpatched hosts: Look for new administrator accounts in wp_users/wp_usermeta. Check for unknown PHP files in wp-content/uploads and wp-content/mu-plugins, and for tampering with wp_options (siteurl, active_plugins). If you find anything, isolate the host and preserve evidence.
   • Rotate secrets if compromise is suspected: Change the DB password and regenerate salts (wp config shuffle-salts). Reset all admin passwords and Application Passwords.
2. 02

   Runbook step 2

   Mitigation layers

   • WAF/IPS: Add a rule for POSTs to batch/v1 whose requests[] entries target internal routes or carry author__not_in, author_exclude or SQL tokens (UNION, SELECT, SLEEP(, 0x, --). Raise OWASP CRS paranoia to level 2 on /wp-json/ so the 942xxx SQLi rules fire.
   • Application config: If the batch endpoint is not needed, drop it via a must-use plugin: add_filter('rest_endpoints', function($e){ unset($e['/batch/v1']); return $e; });. Alternatively, restrict anonymous REST access through rest_authentication_errors. Test the block editor and plugins first, since some rely on the endpoint.
   • Database least privilege: Grant the WordPress DB user rights on its own schema only. Do not grant FILE, SUPER or PROCESS, and set secure_file_priv. This makes the step from SQLi to file write or RCE much harder.
   • Host hardening: Set DISALLOW_FILE_EDIT and, where feasible, DISALLOW_FILE_MODS to true. Deny PHP execution in wp-content/uploads at the web server. Add exec, system, passthru, shell_exec and proc_open to disable_functions.
   • Segmentation: Place WordPress hosts in a DMZ and restrict web-server egress to update servers and required APIs. Make the DB server reachable only from the web tier.
   • Reduce exposure: Put /wp-json/ and /wp-admin/ behind an IP allowlist or an SSO proxy for internal or editor-only sites.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: Watch for unauthenticated POST bursts to the batch endpoint. SPL example: index=web (uri_path="*/wp-json/batch/v1*" OR uri_query="*rest_route=*batch*") http_method=POST | stats count by src_ip, status. Also alert on requests containing author__not_in or author_exclude alongside SQL fragments, including URL-encoded ones.
   • DB and PHP error logs: Spikes of MySQL syntax errors (You have an error in your SQL syntax) or slow-query entries that correlate with batch requests indicate time-based blind SQLi.
   • EDR/Sysmon or auditd: Flag process chains such as php-fpm/apache2/httpd → sh/bash → curl/wget/python/nc. On Linux, use an auditd rule on execve where the parent runs as the web user (uid=www-data). On Windows IIS, look for Sysmon EID 1 with ParentImage php-cgi.exe spawning cmd.exe or powershell.exe.
   • File integrity: Alert on new .php files in uploads/, mu-plugins/ or the webroot via Sysmon EID 11, auditd -w /var/www -p wa or FIM. Sigma shape: logsource: linux/file_event; selection: TargetFilename|contains: '/wp-content/uploads/' AND TargetFilename|endswith: '.php'.
   • Application layer: Detect new administrator users outside change windows (wp user list --role=administrator, diffed against a baseline). Also watch for unexpected plugin activations in your audit-log plugin.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Source: pwn.watch, cvelistv5, NCSC NZ (CC BY 4.0), NVD (NIST), OSV (Open Source Vulnerabilities), CISA KEV Catalog, BSI WID Portal, BSI CSAF

Vendors and products

• Open Source Wordpress
• WordPress WordPress

References & sources

• github.comWordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-…web, Vulnerability database, Technical description
• NVD (NIST)NVD: CVE-2026-63030web, pwn-watch
• wordpress.orgWordPress Core — CVE-2026-60137web, Release notes, Vendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030web, government-resource
• cert.atCERT.at: Kritische Sicherheitslücken in WordPress - Updates verfügbarcert-at
• cert.cyber.gouv.frANSSI / CERT-FR: CERTFR-2026-ALE-007 – Multiples vulnérabilités dans WordPress (clôturée 2026-08-24)cert-fr
• pwn.watchpwn.watch: WordPress Core: WordPress Core SQL Injection Vulnerabilitypwn-watch
• NVD (NIST)NVD: CVE-2026-60137pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 08.10.2026NVD analysis modifiedNVD

2. 07.10.2026Record modifiedWPScan

   New references:

   • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
   • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
   Reference	added	—	https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
   Reference	removed	https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q	—
   Reference	removed	https://wordpress.org/news/2026/07/wordpress-7-0-2-release/	—
   Reference type	removed	https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q Types: Vendor Advisory	—
   Reference type	removed	https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ Types: Release Notes	—

   Source identifier: contact@wpscan.com

3. 07.10.2026Record modifiedCISA ADP

   CVSS V3.1: before AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, after —

   CISA assessment (SSVC): exploitation: active, automatable: yes

   New references:

   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
   Show 6 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   CVSS	removed	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	—
   Reference	added	—	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
   Reference	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030	—
   Reference type	removed	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030 Types: US Government Resource	—
   SSVC assessment	removed	{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T00:00:00+00:00"}	—
   SSVC assessment	added	—	{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-22T03:55:47.123838Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 22.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: active, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T15:45:15.918337Z"}	{"id":"CVE-2026-63030","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-21T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 21.07.2026Initial analysis by NVDNVD

   Newly listed as affected:

   • WordPress (6.9 – before 6.9.5; 7.0 – before 7.0.2)

   New references:

   • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
   • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
   • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
   Show 4 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Product configuration	added	—	OR *cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* versions from (including) 6.9 up to (excluding) 6.9.5 *cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (excluding) 7.0.2
   Reference type	added	—	WPScan: https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q Types: Vendor Advisory
   Reference type	added	—	WPScan: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ Types: Release Notes
   Reference type	added	—	CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030 Types: US Government Resource

   Source identifier: nvd@nist.gov

One NVD translation into another language is hidden.

Linked advisories

• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 29SANS @RISK30.07.2026
• @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 28SANS @RISK23.07.2026
• Update WordPress Now to Fix Actively Exploited wp2shell VulnerabilitiesSANS NewsBites21.07.2026
• Cyber Incidents Reported to Regulators: Craneware and FairlifeSANS NewsBites21.07.2026
• Multiples vulnérabilités dans WordPress (20 juillet 2026)CERT-FR (ANSSI)20.07.2026