CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
Vulnerability summary
CVE-2026-63030 is a critical (CVSS 9.8) Interpretation Conflict vulnerability in WordPress Core. It is known to be exploited: CISA and ENISA list it, first on 21-07-2026. EPSS estimates a 10.65% chance of exploitation in the next 30 days, higher than 95.8% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 6.9.5.
Listed as exploited by ENISA (21-09-2026)
Source freshness unavailable
How is this decided?Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 21-07-2026Added to CISA KEVExploitedWordPress Core Interpretation Conflict Vulnerability
- 24-07-2026CISA remediation dueDeadline passedApply mitigations per vendor instructions.
- 21-09-2026Added to ENISA KEVExploitedAdded to the ENISA known exploited vulnerabilities catalog.
- 07-10-2026Last modifiedVulnerability information updated.
Description
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
10.65%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
Increase +0.53 pp
From 10.12% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 21-07-2026
- Federal due date
- 24-07-2026
ENISA CNWListed- Added
- 21-09-2026
CIRCLNot in the CIRCL catalog.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. wordpress.org/news/2026/07/wordpress-7-0-2-release/ nvd.nist.gov/vuln/detail/CVE-2026-63030
Public exploits
2 foundWordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
auxiliary/scanner/http/wordpress_wp2shell_sqli
Maturity: poc
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
exploit/multi/http/wp_batch_desync_rce
Maturity: weaponized
Weaknesses
CWE · root cause- CWE-436Interpretation ConflictProduct A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
- CWE-670Always-Incorrect Control Flow ImplementationThe code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Wordpress2 products
- wordpress≥ 6.9, < 6.9.5 | ≥ 7.0, < 7.0.2 (fixed in 6.9.5)
- wordpress≥ 6.9.0, < 6.9.5 | ≥ 7.0.0, < 7.0.2 | ≥ 6.9, < 6.9.5 | ≥ 7.0, < 7.0.2
Debian1 product
- wordpress< 7.0.2+dfsg1-1
Ubuntu1 product
- wordpressAll versions (No fix recorded)
3 vendors · 4 products
References
11 links- github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662qVDB EntryTechnical DescriptionREPORTVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030Government ResourceUS Government Resource
