CVE-2026-63030
SQL injection in WordPress REST API allows remote code execution
The flaw is a combination of a REST API batch route confusion and an SQL injection in WordPress core, allowing an attacker to execute arbitrary code on the server. All sites running WordPress 6.9.x before 6.9.5 or 7.0.x before 7.0.2 are affected. CISA has added the vulnerability to its known-exploited list, meaning it is being actively attacked, and a fix is available.
WordPress · Updated 4 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 21 July; US agencies must fix by 24 July
SeveritycriticalCVSS 9.8 of 10
FixAvailableFixed versions below
Am I affected?
If you run a version older than the fixed one for your line, yes.
| Version line | Fixed in |
|---|---|
| WordPress 7.0 | 7.0.2 |
| WordPress 6.9 | 6.9.5 |
What to do
- Update all WordPress installations to version 7.0.2 (for 7.0.x) or 6.9.5 (for 6.9.x) immediately. Review server logs for signs of unauthorized access, as attackers are actively exploiting this vulnerability.
What happened
- 21 JulyCISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to fix by 2026-07-24.
- 4 NovCISA warned that attackers are actively exploiting the flaw, as reported by BleepingComputer and Zotpaper.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-63030 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | critical 9.8 | 21 July | 11% |
Our reporting
4 NovCISA warns WordPress core flaw is under active attackReported elsewhere
BleepingComputer · 4 NovCISA flags WordPress RCE flaw as actively exploited in attacks ↗The records
wordpress.org: advisory ↗CISA known-exploited catalog ↗CVE-2026-63030 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free