Vulnerability in WordPress REST API

WordPress

What happened

A security issue in WordPress could allow an attacker to execute remote code due to a flaw in the REST API. This vulnerability is combined with a SQL injection vulnerability that affects specific versions of WordPress.

Are you affected?

WordPress versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are affected.

What to do now

1. Upgrade to WordPress version 6.9.5 or 7.0.2 as soon as possible.
2. Regularly review your WordPress installation for unauthorized access or changes.

Sources

• cve.now/CVE-2026-63030
• CVE-2026-63030
• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
• https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb
• https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml
• https://github.com/0xBlackash/CVE-2026-63030
• https://github.com/0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL
• https://github.com/0xIIDe231/wp2shell2026
• https://github.com/0xWhoknows/wp2shell
• https://github.com/0xh7ml/CVE-2026-63030
• https://github.com/0xjessie21/wp2shell-checker
• https://github.com/0xsha/wp2shell
• https://github.com/47Cid/wp2shell-lab
• https://github.com/4B3R4M4-607D/CVE-2026-63030-POC
• https://github.com/4minx/CVE-2026-63030
• https://github.com/Adrees-Basheer/wp2shell-vulnerability-scanner
• https://github.com/AnggaTechI/CVE-2026-63030
• https://github.com/Bhanunamikaze/WP2Shell-CVE-2026-63030-POC
• https://github.com/BytesPulse-OE/wp2shell-Hestia-Scanner
• https://github.com/Ch4120N/CVE-2026-63030
• https://github.com/ChiefYoru/CVE-2026-63030_PoC
• https://github.com/Crypto-Cat/wp2shell
• https://github.com/CybersecSpirit/CVE-2026-63030
• https://github.com/DeadExpl0it/wp2shell-poc
• https://github.com/GhostInExile/CVE-2026-63030-Wp2Shell
• https://github.com/Giangdurian/CVE-2026-63030-CVE-2026-60137
• https://github.com/Githu836/PoC-for-CVE-2026-63030
• https://github.com/Icex0/wp2shell-poc
• https://github.com/Industri4l-H3ll-Xpl0it3rs/CVE-2026-63030-WP2Shell
• https://github.com/InstaWP/wp2shell-scan
• https://github.com/Iqbalx7/wp2shell
• https://github.com/J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t
• https://github.com/JohenLastGen-JLG/wp2shell
• https://github.com/Lukols-Dev/wp-cve-2026-63030-check
• https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass
• https://github.com/MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137-
• https://github.com/NULL200OK/WP2Shell
• https://github.com/Procjevt/CVE-2026-63030
• https://github.com/Sec-Dan/WP2Shell-Scanner
• https://github.com/Senanfurkan/wordpress-cve-2026-63030
• https://github.com/Tersurrr/Orga-Tersur-Daniel-CVE-2026-63030
• https://github.com/TomorrowX6/CVE-2026-63030-poc
• https://github.com/ZenithGenius/wordpress-batch-rce-lab
• https://github.com/ZephrFish/wp2shell-scanner
• https://github.com/administrator-01001/CVE-2026-63030
• https://github.com/ananay/wp2shell-lab
• https://github.com/attackercan/wp2shell-poc2
• https://github.com/bahartanir/wp2shell-scanner
• https://github.com/c0gnit00/Wp2Shell
• https://github.com/dexit/CVE-2026-63030
• https://github.com/dinosn/wp2shell-lab
• https://github.com/ekomsSavior/wp2shell
• https://github.com/eyesecurity/wp2shell-compromise-scanner-plugin
• https://github.com/fl0ydsec/CVE-2026-63030
• https://github.com/fullhunt/wp2shell-scan
• https://github.com/g0d150ne/WP2Shell
• https://github.com/gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc
• https://github.com/gbrsh/CVE-2026-63030
• https://github.com/hidden-investigations/wp2shell-scanner
• https://github.com/hitechcloud-vietnam/wp2shell-PoC
• https://github.com/ikow/wp2shell
• https://github.com/imXur/WordPress-CVE-2026-63030-Analysis
• https://github.com/joaovicdev/EXPLOIT-CVE-2026-63030
• https://github.com/johnlodan/wp2shell-rce
• https://github.com/kulichr/wp2shell
• https://github.com/l-i-uqing/CVE-2026-63030-wp2shell-repro
• https://github.com/langz337/CVE-2026-63030
• https://github.com/lucifer0xf/wp2shell-Wordpress-TOWN
• https://github.com/mcipekci/wp2shell
• https://github.com/mhassani97/cve-2026-63030-lab
• https://github.com/mrx-arafat/CVE-2026-63030-POC
• https://github.com/mverschu/CVE-2026-63030
• https://github.com/own2pwn-fr/wp2shell-detect
• https://github.com/raphy76/wp2shell-poc-fulljs
• https://github.com/razureink/cve-2026-63030_60137-wordpress_rce_reproduction
• https://github.com/securelayer7/WordPresShell
• https://github.com/shinthink/CVE-2026-63030
• https://github.com/skelersecurity/wordpress-skelersecurity-core-security-CVE-2026-63030
• https://github.com/tcyph3r/wp2shell-cve-2026-63030-root-cause
• https://github.com/vulnquest58/PressVector
• https://github.com/x-znn/CVE-2026-63030
• https://github.com/yuag/wp2shell
• https://github.com/z3rodayhacks/CVE-2026-63030-CVE-2026-60137
• https://github.com/zi3lak/wp2shell_scanner

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.