6 min read
By: RedLegg's Cyber Threat Intelligence Team
About:
CVE-2026-63030 is a high-severity route-confusion vulnerability affecting the WordPress REST API batch endpoint.
The vulnerability causes WordPress to process a supplied route differently during permission checking and request execution. While CVE-2026-63030 does not directly enable remote code execution on its own, it can be chained with the SQL injection vulnerability CVE-2026-60137 to manipulate database queries and potentially achieve arbitrary code execution on affected servers.
CISA has added CVE-2026-63030 to its Known Exploited Vulnerabilities (KEV) Catalog. Organizations should immediately verify that automatic security updates have been successfully applied or manually install a fixed WordPress version where necessary.
RedLegg will occasionally communicate vulnerabilities released outside the usual release schedule to provide additional value to our customers. These emergency bulletins describe vulnerabilities or threats we classify as the highest severity level and warrant out-of-band emergency patching or mitigation action.
VULNERABILITIES
WordPress REST API Batch-Route Confusion Vulnerability
Identifier: CVE-2026-63030
PoC or Exploitation: CISA added CVE-2026-63030 to the Known Exploited Vulnerabilities catalog.
CVSS Score: 7.5 (High, CVSS v3.1)
Update / Patch:
Affected versions:
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- WordPress 7.1 beta releases earlier than 7.1 beta 2
Fixed versions:
- WordPress 6.9.5 or later
- WordPress 7.0.2 or later
- WordPress 7.1 beta 2 or later
WordPress enabled forced automatic security updates for affected installations. Administrators should verify that updates completed and manually install a fixed version where necessary.
Official security release and update guidance:
Description:
CVE-2026-63030 is a route-confusion vulnerability in the WordPress REST API batch endpoint.
The vulnerability can cause WordPress to process a supplied route differently during permission checking and request execution. When chained with the separate SQL-injection vulnerability CVE-2026-60137, an unauthenticated attacker can manipulate database queries and potentially execute code on the affected server.
CVE-2026-63030 alone should not be characterized as directly providing remote code execution.
Mitigation Recommendation:
Immediately update WordPress 6.9 installations to version 6.9.5 or later and WordPress 7.0 installations to version 7.0.2 or later. Update affected WordPress 7.1 beta installations to beta 2 or later.
Review web-server, REST API, WordPress, database, and endpoint-security telemetry for suspicious batch-endpoint requests, unusual database queries, unauthorized user or configuration changes, unexpected files, and processes launched by the web-server account.
