{"id":"CVE-2026-63030","published":"2026-07-17T20:17:28Z","modified":"2026-10-08T10:35:50Z","title":"WordPress Core Interpretation Conflict Vulnerability","vendor":"WordPress","product":"Core","tier":"core","eol":null,"description":{"text":"WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.","provenance":"source","from":"NVD"},"summary":{"text":"A route confusion flaw in WordPress Core's REST API batch endpoint, affecting the 6.9.x and 7.0.x release branches before their fixed versions, is what lets this issue be leveraged. An unauthenticated remote attacker, requiring no user interaction and using only network access, could chain it with a separate SQL injection in the author__not_in WP_Query parameter to run SQL injection and potentially achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:48Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.10649,"percentile":0.95791,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-07-21","dueDate":"2026-07-24","ransomware":false,"requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-07-17","exploitedFirstSeen":"2026-07-17","ransomware":false,"evidence":[{"url":"https://patchstack.com/database/wordpress/plugin/wordpress/vulnerability/wordpress-core-7-0-1-unauthenticated-remote-code-execution-vulnerability","date":"2026-07-17"},{"url":"https://isc.sans.edu/diary/rss/33168","date":"2026-07-20"},{"url":"https://previdian.com/CVE-2026-63030","date":"2026-07-20"},{"url":"https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137","date":"2026-07-20"},{"url":"https://x.com/kmkz_security/status/2079212253434323246","date":"2026-07-20"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-07-21"},{"url":"https://www.crowdsec.net/vulntracking-report/cve-2026-63030-wordpress-wp2shell-sqli-to-rce","date":"2026-07-28"},{"url":"https://fortiguard.fortinet.com/threat-signal-report/6492","date":"2026-07-29"},{"url":"https://socradar.io/blog/operation-talked-russia-ukraine-defense-industry/","date":"2026-07-30"},{"url":"https://fortiguard.fortinet.com/outbreak-alert/wp2shell-rce","date":"2026-07-31"}],"evidenceTotal":16,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ae254acfd783d5b63290659","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"INC and The Gentlemen Ransomware: Exposed AI Infrastructure","url":"https://otx.alienvault.com/pulse/6ad8db024c84442cd0085496","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-436","name":"Interpretation Conflict"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q","tags":["Vendor Advisory"]},{"url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","tags":["Release Notes"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: unauthenticated attacker exploits public-facing WordPress REST API","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"could allow an attacker to perform SQL Injection and achieve Remote Code Execution","start":196,"end":278}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: SQL injection chained to remote code execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"achieve Remote Code Execution","start":249,"end":278}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-e7dfbcdaedcbed88ea81","title":"SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Research SharePoint 0-day uncovered (CVE-2025-53770)","publisher":"research.eye.security","url":"https://research.eye.security/sharepoint-under-siege/","date":"2025-07-19","mentions":[{"quote":"wp2shell: incident response guide (CVE-2026-63030 + CVE-2026-60137)","start":31057,"end":31124}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-45280","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280","exploited":true,"exploitedSince":"2026-07-21","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":66,"skipped":12,"earliest":"2026-07-17","earliestUrl":"https://github.com/Icex0/wp2shell-poc","repos":[{"name":"Icex0/wp2shell-poc","url":"https://github.com/Icex0/wp2shell-poc","stars":809,"created":"2026-07-17"},{"name":"0xsha/wp2shell","url":"https://github.com/0xsha/wp2shell","stars":121,"created":"2026-07-18"},{"name":"ZephrFish/wp2shell-scanner","url":"https://github.com/ZephrFish/wp2shell-scanner","stars":69,"created":"2026-07-17"},{"name":"dinosn/wp2shell-lab","url":"https://github.com/dinosn/wp2shell-lab","stars":66,"created":"2026-07-18"},{"name":"securelayer7/WordPresShell","url":"https://github.com/securelayer7/WordPresShell","stars":20,"created":"2026-07-18"}]},"metasploit":[{"name":"WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion","module":"auxiliary/scanner/http/wordpress_wp2shell_sqli","type":"auxiliary","disclosureDate":"2026-07-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb"},{"name":"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","module":"exploit/multi/http/wp_batch_desync_rce","type":"exploit","disclosureDate":"2026-07-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb"}],"nuclei":[{"id":"CVE-2026-63030","name":"WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion","severity":"critical","path":"http/cves/2026/CVE-2026-63030.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml"}],"first":{"date":"2026-07-17","source":"PoC-in-GitHub","url":"https://github.com/Icex0/wp2shell-poc"},"provenance":"source"},"detections":{"cveRules":[{"title":"WordPress Wp2shell Webshell Plugin Access","id":"c9e6f412-3d50-4f7e-bf94-5b6c7d8e9f0a","level":"critical","status":"experimental","path":"rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access.yml","techniques":["T1505.003"]},{"title":"WordPress Wp2shell Exploitation Tool User-Agent","id":"a7c4e2f9-1b38-4d5c-9e72-3f4a5b6c7d8e","level":"high","status":"experimental","path":"rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent.yml","techniques":["T1190"]},{"title":"WordPress Wp2shell REST Batch Endpoint Exploitation","id":"b8d5f301-2c49-4e6d-af83-4a5b6c7d8e9f","level":"medium","status":"experimental","path":"rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2026/Exploits/CVE-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse.yml","techniques":["T1190"]}]},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2025-07-19","kind":"report","label":"Named in research.eye.security: SharePoint Under Siege: ToolShell Exploit (CVE-2025-49706 & CVE-2025-49704) - Eye Resea…","url":"https://research.eye.security/sharepoint-under-siege/","provenance":"machine"},{"date":"2026-07-17","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63030","provenance":"source"},{"date":"2026-07-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-07-17","url":"https://github.com/Icex0/wp2shell-poc","provenance":"source"},{"date":"2026-07-17","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://patchstack.com/database/wordpress/plugin/wordpress/vulnerability/wordpress-core-7-0-1-unauthenticated-remote-code-execution-vulnerability","provenance":"source"},{"date":"2026-07-21","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-07-21","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"PoC-in-GitHub","daysToKev":4},"priority":{"score":77.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 106 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.16,"detail":"percentile 0.9579"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"66 PoC-in-GitHub repos; 2 Metasploit modules; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}