A recently discovered vulnerability (CVE-2026-63030) that affects WordPress Core and allow an unauthenticated remote attacker to achieve remote code execution (RCE).
Severity level:
CVSS Score: 9.8/Critical.
Description:
WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. CVE-2026-63030 is a critical REST API batch endpoint route confusion vulnerability in WordPress Core. The flaw causes a mismatch between request validation and execution within the WordPress REST API batch processing mechanism, allowing specially crafted requests to bypass expected security controls. When chained with CVE-2026-60137, an SQL injection vulnerability in WP_Query, an unauthenticated attacker can achieve remote code execution and fully compromise a vulnerable WordPress site.
Affected Versions:
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0 through 7.0.1
- WordPress 7.1 beta releases prior to 7.1 beta 2
Impact:
Successful exploitation may allow attackers to execute arbitrary code on the affected server.
Resolution:
Upgrade affected WordPress installations to:-
- WordPress 6.9.5 or later.
- WordPress 7.0.2 or later.
- WordPress 7.1 beta 2 or later.
Reference:
UIT Information Security