/Vulnerability Library

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

CVE-2026-63030
Verified

Description

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint (/?rest_route=/batch/v1). A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach unintended REST API handlers and bypass authorization checks. This route confusion can be chained with a SQL injection flaw (CVE-2026-60137) in the author_exclude parameter to extract database contents and ultimately achieve remote code execution. This template safely detects the vulnerable handler state via the route confusion behavior alone, without executing SQL or relying on response timing.

Severity

Critical

CVSS Score

9.8

Exploit Probability

11%

Affected Product

wordpress

Published Date

July 18, 2026

Template Author

slcyber, mielverkerken, pdteam
+1

CVE-2026-63030.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-63030
CWE ID:
cwe-287

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662qhttps://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjfhttps://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-corehttps://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shellhttps://wordpress.org/news/2026/07/wordpress-7-0-2-release/https://github.com/sergiointel/wp2shell-poc/

Remediation Steps

Update WordPress immediately to version 6.9.5 or 7.0.2. As a temporary mitigation, block POST requests to /wp-json/batch/v1 and /?rest_route=/batch/v1 at the WAF or reverse proxy level.