What it is
On July 17, 2026, NVD published CVE-2026-63030, a critical flaw in WordPress core. The community named the chain WP2Shell: REST API batch route confusion (/?rest_route=/batch/v1) plus SQL injection in the author__not_in parameter (CVE-2026-60137), leading to unauthenticated remote code execution.
Exploitation
- July 20: CrowdSec sees first exploitation and ships a detection rule.
- July 21: CISA adds the CVE to the KEV catalog, with a federal deadline of July 24.
- Severity is CVSS 9.8, with a public PoC and Nuclei template. Within days, thousands of unique IPs were scanning the internet.
Affected versions and fix
Affects WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2. Fixed in those releases. Because it is a core bug, no plugin is required: any outdated internet-facing site is a target.
What to do
Update immediately to 7.0.2 or 6.9.5, confirm auto-updates actually applied (including staging and managed hosts) and watch the REST batch endpoint. For SMEs and agencies, this is top priority: WordPress runs about a third of the web.