CVE-2026-63030
WordPress Core Interpretation Conflict Vulnerability
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-07-24.
14 articles across 9 outlets · first covered Jul 17, 2026 · latest Oct 12, 2026
Associated threat actors
Coverage timeline
-
AI Powered Campaign Breaches Ukrainian Infrastructure and 429 WordPress Sitesthehackernews.com · Oct 12, 2026
-
Suspected Chinese Actor Exposed 18,566 Government Records in Campaignsecurityonline.info · Sep 22, 2026
-
UK firms must patch now as CISA flags six active exploitssecurityonline.info · Jul 27, 2026
-
CISA adds DDWRT, Langflow and WordPress bugs to KEV listsecurityaffairs.com · Jul 22, 2026
-
CISA warns of active exploits in WordPress, Langflow, DDWRTsecurityonline.info · Jul 21, 2026
-
CISA Warns of Critical WordPress Flaw CVE‑2026-63030 in KEVcisa.gov · Jul 21, 2026
-
Critical WordPress Bug Lets Attackers Run Code Remotelysecurityonline.info · Jul 21, 2026
-
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeoverwww.darkreading.com · Jul 20, 2026
-
WordPress core flaw CVE-2026-63030 lets attackers execute codeisc.sans.edu · Jul 20, 2026
-
AI crafted WordPress exploit chain triggers urgent CVE patcheswww.infosecurity-magazine.com · Jul 20, 2026
-
WordPress flaws CVE-2026-60137 and CVE-2026-63030 allow RCEwww.securityweek.com · Jul 20, 2026
-
Public PoC exploits hit critical WordPress CVEs, urging patchessecurityaffairs.com · Jul 19, 2026
-
WordPress SQLi bug allows remote code execution, update nowsecurityonline.info · Jul 18, 2026
-
WordPress REST API flaw lets attackers run code remotelywww.rapid7.com · Jul 17, 2026