Vulnerability Description
CVE-2026-63030 (CVSS 9.8, Critical) is an unauthenticated route-confusion vulnerability in the WordPress REST API batch endpoint that can be chained with a related SQL injection flaw in WP_Query (CVE-2026-60137) to achieve remote code execution. The route confusion causes the WordPress REST API batch-processing logic to misidentify the target route for a batched request, bypassing intended request validation and parameter sanitization. On its own, the WP_Query SQL injection is not directly reachable without authentication on a default WordPress installation because REST API validation normally sanitizes the affected input, but the route confusion bypasses that validation. Chained, an attacker can craft recursive REST API batch requests that deliver unsanitized SQL into the database. The demonstrated exploit then abuses WordPress post-caching and customization logic to temporarily assume administrator privileges, create a new administrator account, and upload a malicious plugin to execute code on the underlying server. Searchlight Cyber discovered CVE-2026-63030 and named the chain “wp2shell.”
| Field | Description |
| CVE-ID | CVE-2026-63030 — CVSS 9.8 — assigned by WPScan CVE-2026-60137 — CVSS 5.9 — assigned by WPScan |
| Vulnerability Description | CVE-2026-63030 is an unauthenticated REST API batch-endpoint route-confusion vulnerability in WordPress that can be chained with a related SQL injection flaw in WP_Query (CVE-2026-60137) to achieve remote code execution. The route confusion causes the WordPress REST API batch-processing logic to misidentify the target route for a batched request, bypassing intended request validation and parameter sanitization. On its own, the WP_Query SQL injection is not directly reachable without authentication on a default WordPress installation because REST API validation normally sanitizes the affected input, but the route confusion bypasses that validation. Chained, an attacker can craft recursive REST API batch requests that deliver unsanitized SQL into the database. The demonstrated exploit then abuses WordPress post-caching and customization logic to temporarily assume administrator privileges, create a new administrator account, and upload a malicious plugin to execute code on the underlying server. Searchlight Cyber discovered CVE-2026-63030 and named the chain “wp2shell.” |
| Date of Disclosure | July 17, 2026 |
| Affected Assets | WordPress |
| Vulnerable Software Versions | CVE-2026-63030: WordPress versions 6.9.0 through 6.9.4 (>= 6.9.0 and < 6.9.5) and 7.0.0 through 7.0.1 (>= 7.0.0 and < 7.0.2). CVE-2026-60137: WordPress versions 6.8.0 through 6.8.5 (>= 6.8.0 and < 6.8.6), 6.9.0 through 6.9.4 (>= 6.9.0 and < 6.9.5), and 7.0.0 through 7.0.1 (>= 7.0.0 and < 7.0.2). |
| PoC Available | Yes. Public PoCs demonstrating the full chain are available. VulnCheck listed more than two dozen related PoCs as of July 19, 2026. |
| Exploitation Status | In-the-wild activity has been reported since initial disclosure. |
| Patch Status | Upgrade to 6.9.5 or 7.0.2 (or 6.8.6 on the 6.8 branch). WordPress auto-updates minor releases by default; verify that automatic updates are enabled and confirm the running version. If immediate patching is not possible, temporarily block anonymous access to the REST API batch endpoint, either by blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 with a WAF or by installing a plugin that blocks anonymous REST API access. These are emergency measures only and may affect legitimate site functionality. |
Censys ARC Perspective
As of July 20, 2026, Censys observes approximately 62.8 million WordPress instances globally. Only about 25 percent (15.9 million) expose a version through the generator tag. The remainder cannot be version-classified from scan data and are not confirmed patched, so the real totals are likely higher.
Within the version-visible instances:
| Scope | Instances | Share of version-visible | Share of all WordPress instances |
|---|---|---|---|
| CVE-2026-60137 affected range (6.8.x, 6.9.x, 7.0.x) | ~8.60M | ~54% | ~14% |
| CVE-2026-63030 chain-eligible range (6.9.x, 7.0.x) | ~7.74M | ~49% | ~12% |
The affected instances cluster just below the fixes. WordPress 7.0.1, the release one increment below the 7.0.2 patch, accounts for roughly 5.11 million on its own (close to 60 percent of the affected instances); 6.9.4 adds ~1.54 million, and the 6.8.x branch contributes about 865,000. Roughly 960,000 report a bare two-segment release with no patch digit (7.0: ~810,000; 6.9: ~150,000).
Separately, a host-level view (a distinct and much smaller dataset of ~33,000 hosts) shows affected hosts concentrated on managed-hosting and cloud providers, led by Amazon Web Services (AWS), DigitalOcean, Hetzner, OVH, and GoDaddy, and skewed towards the United States (~34 percent), then Germany, Hong Kong, France, Japan, and Singapore.
The Censys Rapid Response team has notified Censys ARC customers with potentially affected WordPress instances in their attack surfaces.
References
- NVD – CVE-2026-63030
- NVD – CVE-2026-60137
- REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`
- WordPress 7.0.2 Release
- Upgrading WordPress – Advanced Administration Handbook | Developer.WordPress.org
- VulnCheck – Outpace Adversaries
- wp2shell: Pre Authentication RCE in WordPress Core › Searchlight Cyber