CVE-2026-63030: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-63030 is a critical REST API batch-route confusion vulnerability in WordPress core that, when chained with the author__not_in WP_Query SQL Injection (CVE-2026-60137), enables unauthenticated remote code execution. It affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1. The vulnerability was discovered and responsibly disclosed by Adam Kues at Assetnote / Searchlight Cyber, and was publicly disclosed on July 17, 2026. Patched versions 6.9.5 and 7.0.2 were released on the same day. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Feedly).

The root cause is classified as CWE-436 (Interpretation Conflict), where the WordPress REST API /batch/v1 endpoint misinterprets route parameters in a way that can be abused to reach internal query logic. This route confusion, when combined with the SQL injection flaw in WP_Query's author__not_in parameter (CVE-2026-60137, CWE-89), allows an unauthenticated attacker to inject arbitrary SQL commands through crafted batch API requests. No authentication or user interaction is required, and the attack is fully network-accessible. Public PoC scripts demonstrate both time-based blind SQL injection for data extraction and post-authentication webshell upload for full RCE (GitHub Advisory, wp2shell PoC, PoC SQLi).

Successful exploitation allows an unauthenticated remote attacker to perform arbitrary SQL injection against the WordPress database, potentially exposing all stored data including credentials, user PII, and site content. The attack chain further enables remote code execution on the underlying server, granting the attacker full control of the WordPress installation and potentially the hosting environment. This creates risk of complete site takeover, lateral movement within shared hosting environments, data exfiltration, and deployment of persistent backdoors or webshells (GitHub Advisory, Wordfence, Rapid7).

1. Reconnaissance: Use tools like Shodan, Censys, or the wp2shell-scanner to identify internet-facing WordPress instances running versions 6.9.0–6.9.4 or 7.0.0–7.0.1. Confirm the REST /batch/v1 endpoint is reachable by sending a benign probe request.
2. Trigger route confusion: Craft a malicious HTTP request to the REST API /wp-json/batch/v1 endpoint that exploits the batch-route interpretation conflict, causing the server to route the request in an unintended way that reaches the vulnerable WP_Query code path.
3. Inject SQL payload: Include a crafted author__not_in parameter value containing a SQL injection payload (e.g., time-based blind injection using SLEEP()) within the batch request body to confirm exploitability and extract data from the WordPress database.
4. Extract sensitive data: Use the read command of wp2shell.py to iteratively extract database contents (e.g., admin credentials, secret keys) via blind SQL injection.
5. Achieve RCE (post-auth): Using extracted admin credentials, authenticate to the WordPress admin panel and use the shell command of wp2shell.py to upload a malicious plugin or webshell, achieving full remote code execution on the server (wp2shell PoC, PoC SQLi, Rapid7).

• Network: Unusual or repeated HTTP POST requests to /wp-json/batch/v1 with unexpected or encoded body parameters; outbound connections from the web server to unknown external IPs following REST API activity; anomalous SQL query timing patterns (e.g., delayed responses consistent with SLEEP()-based blind injection).
• Logs: WordPress/web server access logs showing high-frequency or automated requests to /wp-json/batch/v1; PHP error logs containing SQL-related exceptions or warnings from WP_Query; admin panel login events from unfamiliar IPs shortly after REST API anomalies.
• File System: Newly created or modified PHP files in the WordPress plugins or uploads directory (potential webshells); unexpected .php files with obfuscated content or eval/base64 patterns.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) not associated with normal WordPress operation (wp2shell PoC, Wordfence).

WordPress has released patched versions 6.9.5 and 7.0.2 (as well as 7.1 beta2) which address both CVE-2026-63030 and the related CVE-2026-60137. Site administrators should update immediately via the WordPress admin dashboard or by downloading the latest release from wordpress.org. As interim mitigations, deploying a Web Application Firewall (WAF) with rules targeting SQL injection patterns in REST API requests is recommended — Cloudflare, Imperva, and MalCare have all confirmed WAF-level protections are in place. Additionally, restricting or rate-limiting access to the /wp-json/batch/v1 endpoint at the server or firewall level can reduce exposure until patching is complete (GitHub Advisory, WordPress Release, Wordfence).

The vulnerability, dubbed wp2shell, generated significant community attention immediately after disclosure on July 17, 2026, trending across security forums, social media, and threat intelligence platforms. Wordfence issued a public service announcement urging immediate patching, while Rapid7, VulnCheck, Imperva, Cloudflare, and MalCare all published technical analyses and confirmed WAF-level protections for their customers (Wordfence, Rapid7, Imperva). BleepingComputer and The Hacker News covered the story prominently, noting the availability of public exploits and the emergency nature of the patch release on a Friday. Security researchers on Mastodon, Bluesky, and Reddit discussed the vulnerability chain extensively, with multiple independent PoC implementations appearing within hours of disclosure (BleepingComputer, The Hacker News).