Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Scanner template Public exploit CVE-2026-63030 EUVD-2026-45280

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

Published Jul 17, 2026 · Updated Oct 7, 2026 · Assigned by WPScan

Vendor: WordPress Product: WordPress Package: wordpress Package: wordpress Category: Web / CMS Ecosystem: Debian Ecosystem: Ubuntu

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Affected products

VendorProductAffectedFixed
WordPress WordPress 6.9.0 – < 6.9.5, 7.0.0 – < 7.0.2 6.9.5

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 wordpress 7.0.2+dfsg1-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 wordpress No fix yet —
Ubuntu 26.04 LTS wordpress No fix yet —
Ubuntu 24.04 LTS wordpress No fix yet —
Ubuntu 22.04 LTS wordpress No fix yet —
Ubuntu 20.04 LTS wordpress No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS wordpress No fix yet —
Ubuntu 16.04 LTS wordpress No fix yet —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 2 modules

GitHub 76 repositories · most starred shown

  • Icex0/wp2shell-poc ★ 813 · Jul 17, 2026

    wp2shell (CVE-2026-63030 & CVE-2026-60137) - full RCE chain

  • 0xsha/wp2shell ★ 125 · Jul 18, 2026

    CVE-2026-63030 + CVE-2026-60137 - “wp2shell”: unauthenticated RCE in WordPress core

  • ZephrFish/wp2shell-scanner ★ 71 · Jul 17, 2026

    CVE-2026-63030, CVE-2026-60137, wp2shell scanner

  • dinosn/wp2shell-lab ★ 67 · Jul 18, 2026

    Non-destructive detector + Docker lab for wp2shell (CVE-2026-63030 REST /batch/v1 route confusion + CVE-2026-60137 author__not_in SQLi) in WordPress core 6.9.0-6.9.4 / 7.0.0-7.0.1

  • securelayer7/WordPresShell ★ 20 · Jul 18, 2026

    Pre-auth RCE PoC for CVE-2026-63030 / CVE-2026-60137 (WordPress core)

  • mcipekci/wp2shell ★ 18 · Jul 22, 2026

    Pre-auth RCE PoC for WordPress core — chains CVE-2026-63030 (REST /batch/v1 route-confusion desync) with CVE-2026-60137 (author__not_in SQLi) into an unauthenticated shell. Authorized testing only.

  • ikow/wp2shell ★ 17 · Jul 19, 2026

    wp2shell — WordPress Core Pre-Auth RCE (CVE-2026-63030 + CVE-2026-60137). Exploit toolkit + remediation.

  • NULL200OK/WP2Shell ★ 17 · Jul 18, 2026

    WP2Shell - CVE-2026-63030 / CVE-2026-60137 This tool exploits a critical SQL injection vulnerability in the WordPress REST API `/wp-json/batch/v1` endpoint, allowing unauthenticated attackers to exec…

  • 47Cid/wp2shell-lab ★ 15 · Jul 18, 2026

    Educational PoC + lab for CVE-2026-63030 + CVE-2026-60137: pre-auth SQLi in WordPress core via REST batch-route confusion

  • ekomsSavior/wp2shell ★ 11 · Jul 18, 2026

    CVE-2026-63030 (RCE) + CVE-2026-60137 (SQLi)

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 2

References