CVE-2026-63030

This bug is in WordPress’s public REST API—like a “back door” route the site uses for certain requests. Attackers can confuse how the requests are handled, then use that confusion to trick the site into running malicious database instructions, which can escalate into complete control of the site (for example by installing a webshell).

This matters if you run WordPress websites using versions earlier than 7.0.2 (and 6.9.x earlier than 6.9.5), especially if your site is reachable from the internet. The attack does not require a login or user interaction, so scanning and opportunistic attacks can target you without you doing anything. The practical risk is highest when your WordPress site’s REST API is publicly reachable.

This is a RED issue because it is being actively exploited in the wild, not just discussed or theoretically possible. CISA has included it in KEV with a remediation deadline of 2026-07-24, so delays directly increase the chance of takeover attempts succeeding against internet-facing sites.

Confirm exposure

1. Check your WordPress version:
   • In WordPress Admin: go to Dashboard → Updates (or Tools → Site Health / About WordPress) and note the version number.
2. Determine whether you fall into either affected range:
   • WordPress 6.9.x before 6.9.5
   • WordPress 7.0.x before 7.0.2

Upgrade remediation (target fix)

3. Upgrade WordPress to the fixed version for your branch:
   • If you’re on 6.9.x, upgrade to 6.9.5.
   • If you’re on 7.0.x, upgrade to 7.0.2.
4. After the upgrade, immediately verify:
   • The site still loads normally.
   • Your REST API endpoints respond as expected.

Temporary mitigation if patching is delayed

5. Restrict public access to WordPress REST API endpoints until patched:
   • Use your web server rules or a WAF to block or rate-limit calls to REST API routes.
   • If your business relies on REST API functionality, block selectively and test carefully.

Post-upgrade incident checks (because exploitation is confirmed)

6. Inspect your site for signs of compromise:
   • Check for unexpected files (commonly webshell-like files placed in theme/plugin/content directories).
   • Review installed plugins and themes for anything you did not install or recognize.
   • Look for recent changes in file timestamps in wp-content.
7. If you find suspicious items:
   • Remove the malicious plugin/theme/files.
   • Rotate any exposed credentials (especially WordPress admin/user passwords and hosting control panel credentials).

KEV timing

8. CISA KEV remediation due date: 2026-07-24.

What to monitor next

9. Monitor web access logs for repeated probing/scanning and for unexpected POST/GET requests to REST API endpoints.
10. Monitor for new admin users and changes to WordPress configuration and database-backed settings.

Severity and risk: This is a critical, internet-reachable weakness with a full takeover end goal, reflected by CISA KEV listing and active exploitation. The weakness is described as a REST API batch-route confusion (CWE-436) that can be used without authentication, via network requests, to trigger a SQL injection condition and then achieve Remote Code Execution. Exploitation status: KEV confirms it is actively exploited in the wild; news reports describe mass scanning and attacker behaviors including deploying webshells, installing malicious plugins, and exfiltrating credentials. Patch status: Fixed in WordPress 6.9.5 and 7.0.2. EPSS: a predictive score exists, but KEV/news confirmation takes precedence over prediction for urgency. KEV meaning here: inclusion indicates CISA has high confidence it is being exploited, requiring prioritized remediation across affected assets.