CVE-2026-63030: WordPress REST API RCE via Chained SQL Injection

Overview

CVE-2026-63030 is a critical vulnerability affecting WordPress Core, specifically its REST API batch endpoint. This flaw, when combined with a separate SQL Injection vulnerability (CVE-2026-60137), enables unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations. Given its CVSS score of 9.8 and confirmed active exploitation, immediate patching is essential for all affected WordPress sites.

Technical Analysis

• Vulnerability Type: Interpretation Conflict (CWE-436) leading to SQL Injection and Remote Code Execution.
• Affected Versions:
  • WordPress versions 6.9.x before 6.9.5
  • WordPress versions 7.0.x before 7.0.2
• Attack Vector: Network (AV:N), Low Attack Complexity (AC:L), No Privileges Required (PR:N), No User Interaction (UI:N). CVSS 3.1 Base Score: 9.8 (CRITICAL).
• Mechanism: The vulnerability chain involves two distinct issues:
  1. CVE-2026-63030: A REST API batch endpoint route confusion issue. This allows an attacker to manipulate how the batch endpoint processes requests.
  2. CVE-2026-60137: An author__not_in WP_Query SQL Injection. This SQLi can be triggered through the confused batch endpoint.
• Exploitation: An unauthenticated attacker can leverage the route confusion to inject malicious SQL queries via the author__not_in parameter. This SQL injection can then be escalated to achieve Remote Code Execution, potentially leading to webshell deployment or direct command execution. Tools like CMSmap have been linked to exploitation attempts.

Detection

• Web Server Logs: Monitor web server access logs for unusual requests to WordPress REST API batch endpoints, specifically wp-json/batch/v1/ or similar paths, containing suspicious parameters (e.g., author__not_in) or large, malformed POST bodies.
• Process Creation: Look for unexpected child processes spawned by the web server process (e.g., httpd, nginx, w3wp.exe, php-cgi.exe). Specifically, monitor for cmd.exe, powershell.exe, sh, or bash being executed.
• File System Monitoring: Detect creation of suspicious files (e.g., .php, .asp, .jsp files) in WordPress web root directories, particularly wp-content/uploads/ or wp-includes/, by the web server process. These could indicate webshell deployment.
• Database Logs: If available, monitor database logs for unusual or malformed SQL queries, especially those targeting user or option tables, originating from the WordPress application.

Sigma Detection Rules

WordPress REST API Batch Endpoint Suspicious Request

title: WordPress REST API Batch Endpoint Suspicious Request
id: 9283e01a-f1c2-4a7b-a1c3-2d4e5f6g7h8i
status: experimental
description: Detects suspicious requests to the WordPress REST API batch endpoint, potentially indicating exploitation attempts for CVE-2026-63030 chained with CVE-2026-60137.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1/'
    cs-method: ['POST', 'PUT']
    c-uri|contains: 'author__not_in'
  condition: selection
level: high

Web Server Spawning Shell Process

title: Web Server Spawning Shell Process
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects a web server process spawning a shell interpreter, indicative of successful Remote Code Execution (RCE).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: 
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\pwsh.exe'
  condition: selection
level: critical

Web Server Creating Suspicious File in WordPress Directories

title: Web Server Creating Suspicious File in WordPress Directories
id: f0e9d8c7-b6a5-4321-fedc-ba9876543210
status: experimental
description: Detects a web server process creating suspicious files (e.g., webshells) in common WordPress upload or include directories, a common post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-includes\'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
      - '.asp'
      - '.aspx'
      - '.jsp'
      - '.jspx'
  condition: selection
level: high

Mitigations

1. Patch Immediately: Upgrade WordPress to version 6.9.5 or 7.0.2, or later, as soon as possible. These versions contain the necessary fixes for both CVE-2026-63030 and CVE-2026-60137.
2. Restrict REST API Access: If feasible and not critical for site functionality, consider limiting access to the WordPress REST API endpoint (/wp-json/) at the web server or WAF level, especially for unauthenticated users.
3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known SQL injection patterns and suspicious requests targeting WordPress REST API endpoints.
4. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges to limit the impact of successful exploitation.
5. Regular Backups: Maintain regular, tested backups of WordPress sites and databases to facilitate recovery in case of compromise.

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-63030
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
• https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
• https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1190 — Exploit Public-Facing Application
• T1505.003 — Web Shell
• T1059.003 — Windows Command Shell
• T1059.004 — Unix Shell
• T1140 — Deobfuscate/Decode Files or Information
• T1087 — Account Discovery
• T1059 — Command and Scripting Interpreter
• T1083 — File and Directory Discovery
• T1552.001 — Credentials In Files
• T1078 — Valid Accounts
• T1068 — Exploitation for Privilege Escalation
• T1027 — Obfuscated Files or Information
• T1027.002 — Software Packing
• T1071.001 — Web Protocols
• T1136 — Create Account
• T1018 — Remote System Discovery
• T1046 — Network Service Discovery