A recently discovered vulnerability (CVE-2026-63030) that affects WordPress Core and allow an unauthenticated remote attacker to achieve remote code execution (RCE). Severity level: CVSS Score: 9.8/Critical. Description: WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. CVE-2026-63030 is a critical REST API batch endpoint route confusion vulnerability in WordPress Core. The flaw causes a mismatch between request validation and execution within the WordPress REST API batch processing mechanism, allowing specially crafted requests to bypass expected security controls. When chained with CVE-2026-60137, an SQL injection vulnerability in WP_Query, an unauthenticated attacker can achieve remote code execution and fully compromise a vulnerable WordPress site. Affected Versions:
WordPress 6.9.0 through 6.9.4
WordPress 7.0 through 7.0.1
WordPress 7.1 beta releases prior to 7.1 beta 2
Impact: Successful exploitation may allow attackers to execute arbitrary code on the affected server. Resolution: Upgrade affected WordPress installations to:-
