CVE-2026-63030 WordPress Core Interpretation Conflict
Attackers can exploit REST API route confusion and SQL injection to achieve remote code execution on WordPress installations.
- Exploited in the wild
- Since 21 Jul 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-63030?
CVE-2026-63030 is a critical SQL injection vulnerability in Wordpress Wordpress, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Weakness: CWE-436
Which versions are affected by CVE-2026-63030?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | From 6.9.0 | 6.9.5, 7.0.2 |
wordpress-multisite Bitnami | From 6.9.0 | 6.9.5, 7.0.2 |
Products include Wordpress Wordpress.
How do I fix CVE-2026-63030?
Upgrade wordpress to a fixed version for your release line: 6.9.5 or 7.0.2. US federal agencies must fix it by 24 Jul 2026.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-63030 being exploited?
Yes. Attackers have exploited CVE-2026-63030 in the wild since at least 21 Jul 2026.
Public exploit code: 2 Metasploit modules, 1 Nuclei template and 78 proofs of concept on GitHub.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as BIT-wordpress-2026-63030, BIT-wordpress-multisite-2026-63030, DEBIAN-CVE-2026-63030, MINI-3225-xjqh-8h8q, MINI-9p9r-7ppc-qj84, UBUNTU-CVE-2026-63030.