CVE-2026-63030 – Pre-Auth RCE via REST API Route Confusion + SQL Injection – WordPress 6.8.x / 6….

Summary

CVE-2026-63030 ("wp2shell") is a pre-authentication Remote Code Execution vulnerability in WordPress Core, affecting versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2). It chains a route confusion flaw in the REST API batch endpoint with a SQL injection in WP_Query (CVE-2026-60137), enabling an unauthenticated attacker to execute arbitrary code on a default WordPress installation — no plugins, no special configuration, and no credentials required. Security patches were released on July 17, 2026, and WordPress.org has enabled forced automatic updates for affected installations.

Technical details

• Root cause: A route confusion condition in WordPress Core’s REST API batch endpoint (WP_REST_Server::serve_batch_request_v1()) causes attacker-controlled input to be misrouted or interpreted incorrectly, classified under CWE-436 (Interpretation Conflict). This flaw is reachable when a persistent object cache is not in use on the target installation.

• Chained vulnerability: The route confusion is leveraged to trigger CVE-2026-60137, a SQL injection via the author__not_in parameter in WP_Query, allowing arbitrary SQL commands to be injected against the underlying database.

• Attack vector: Fully unauthenticated, network-accessible attack. No valid account, plugin, or non-default configuration is required. No user interaction is needed.

• Impact: Successful exploitation results in SQL injection against the WordPress database and Remote Code Execution on the underlying server, enabling complete website and host compromise.

• Exploit complexity: Low. Multiple public proof-of-concept repositories exist, and a detection template has been merged into the official nuclei-templates repository, significantly lowering the bar for exploitation.

Affected software

• WordPress 6.8.0 through 6.8.5 (all versions before 6.8.6)

• WordPress 6.9.0 through 6.9.4 (all versions before 6.9.5)

• WordPress 7.0.0 through 7.0.1 (all versions before 7.0.2)

Severity

NVD records two CVSS v3.1 base scores for this vulnerability:

• 9.8 Critical (WPScan CNA): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• 7.5 High (CISA-ADP): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

• Immediate action — patch: Upgrade to WordPress 6.8.6, 6.9.5, or 7.0.2 immediately. WordPress.org has enabled forced automatic updates for affected installations. Administrators should verify that every internet-facing WordPress site has successfully updated.

• Interim WAF mitigation (if immediate patching is not possible): Block requests to the batch API endpoints /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF or network layer to reduce exposure until patching can be performed.

• Interim application-level mitigation: Disable anonymous REST API access until the patch can be applied.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

WAF Mitigation ✨

Akamai App & API Protector

⚠️ Note: The suggested rule below blocks the entire batch endpoint, not just the malicious pattern – legitimate plugins/integrations using /wp-json/batch/v1 will also be blocked. Recommend deploying in monitor mode first and validating traffic before enforcing.

In Akamai Control Center (Security Configuration → your security policy → Custom Rules → Create a custom rule):

• Rule logic: match ANY of the following (OR)

• Path → is one of (wildcard): /wp-json/batch/v1*

• Query Parameter → rest_route → equals /batch/v1*, *batch/v1*

You can also add this custom rule via Akamai API/CLI or the Akamai Custom Rule Builder Assistant:

{
  "name": "WordPress-CVE-2026-63030-REST-Batch-v1-Block",
  "description": "Blocks all requests to the WordPress REST API batch/v1 endpoint (both pretty-permalink and ?rest_route= routing), the interim mitigation for CVE-2026-63030 ("wp2shell") pre-auth RCE via REST batch route confusion chained into the CVE-2026-60137 SQL injection in WP_Query author__not_in / author_exclude. WordPress core has no supported way to disable the batch endpoint short of a plugin/mu-plugin, so blocking it at the edge is the documented stop-gap until sites patch to 6.8.6/6.9.5/7.0.2.",
  "operation": "OR",
  "conditions": [
    {
      "type": "pathMatch",
      "positiveMatch": true,
      "value": [
        "/wp-json/batch/v1*"
      ],
      "valueCase": true,
      "valueIgnoreSegment": false,
      "valueNormalize": true,
      "valueWildcard": true
    },
    {
      "type": "uriQueryMatch",
      "name": "rest_route",
      "nameCase": false,
      "nameWildcard": false,
      "positiveMatch": true,
      "value": [
        "/batch/v1*",
        "*batch/v1*"
      ],
      "valueCase": false,
      "valueWildcard": true
    }
  ],
  "tag": [
    "CVE-2026-63030",
    "CVE-2026-60137"
  ]
}

Deploy to Akamai App & API Protector

⚠️ Note: WAF mitigation rules are in preview and not yet generally available.