CVE-2026-63030 — WordPress Core: WordPress Core Interpretation Conflict Vulnerability

1. Executive summary

WordPress Core is affected by a critical interpretation conflict vulnerability (CVE-2026-63030, CVSS 9.8 CRITICAL) in the REST API batch endpoint, which is actively being exploited in the wild and was added to the CISA KEV on 2026-07-21. When chained with a medium-severity SQL injection flaw (CVE-2026-60137, CVSS 5.9 MEDIUM, also in CISA KEV) in the WP_Query author__not_in parameter, unauthenticated attackers can achieve remote code execution on default WordPress installations without requiring plugins or user interaction. EMEA financial services organisations running WordPress versions 6.9.0–6.9.4 or 7.0.0–7.0.1 for public-facing websites, customer portals, or internal CMS platforms face immediate risk of complete system compromise, credential exfiltration, and downstream lateral movement.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability mechanism

CVE-2026-63030 (CVSS 9.8, CWE-436 — Interpretation Conflict) is a REST API batch-route confusion vulnerability introduced in WordPress 6.9. The flaw exists in the batch endpoint at /?rest_route=/batch/v1 (also reachable as /wp-json/batch/v1). When processing batched sub-requests, a route confusion flaw causes the arrays containing sub-requests, validation results, and matched handlers to become misaligned. WordPress loses track of which requests have been properly validated and treats all requests as trusted — including those it should block. This allows an unauthenticated attacker to bypass security validation on individual sub-requests within the batch.

CVE-2026-60137 (CVSS 5.9, CWE-89 — SQL Injection) is a SQL injection vulnerability in the author__not_in (rendered as author_exclude) parameter of WP_Query, present in WordPress 6.8.0 and later. It is exploitable when a plugin or theme passes untrusted input to this parameter. On its own it is a medium-severity SQLi; when chained with CVE-2026-63030's validation bypass, the SQLi becomes reachable by an unauthenticated attacker through the REST API batch endpoint.

Note on CVSS discrepancy: Rapid7's blog initially reported a CVSS score of 7.5 for CVE-2026-63030, citing the GitHub Security Advisory. The VERIFIED REFERENCE DATA assigns CVSS 9.8 CRITICAL (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). We use the verified 9.8 assessment. The 7.5 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) visible in NVD likely reflects an earlier or alternative scoring that considered only the route confusion in isolation without the RCE chain impact.

Affected versions

The full unauthenticated RCE chain is only achievable on 6.9.x and 7.0.x installations because CVE-2026-63030 was introduced in WordPress 6.9. WordPress 6.8.x is affected by CVE-2026-60137 as a standalone SQL injection issue only.

Preconditions

• No authentication required.
• No user interaction required.
• No plugins or themes required — exploitable against a stock/default WordPress installation.
• The WordPress REST API must be exposed (default behaviour).
• Cloudflare reported that the vulnerable code path is reached when a persistent object cache is not in use — meaning default installations without a persistent object cache (e.g., Redis, Memcached) are vulnerable.

Confirmed attack chain

1. Initial access — REST API batch endpoint: The attacker sends an unauthenticated HTTP POST request to /?rest_route=/batch/v1 with Content-Type: application/json. The request body contains a nested batch of sub-requests. The outer batch structure exploits the route confusion flaw (CVE-2026-63030), causing WordPress to misalign validation results and treat untrusted sub-requests as validated.
2. SQL injection via WP_Query: Within the batch, a crafted GET sub-request targets /wp/v2/posts/999999 with the author_exclude parameter set to a SQL injection payload. The parameter name author_exclude maps to author__not_in in WP_Query. The injection closes the existing query parenthesis with 0) and appends a UNION SELECT statement. The route confusion ensures this sub-request bypasses input validation that would normally sanitise or block it.
3. Verification query (observed in honeypots): The first-stage payload is a reconnaissance query that injects a UNION SELECT returning a row containing the string ||OK|| (hex-encoded as 0x7c7c delimiters around HEX(CAST((SELECT 0x4f4b)AS CHAR))). This confirms SQL injection is possible. The hex value 0x4f4b decodes to OK.
4. Payload delivery — PHP webshell injection: The second-stage query uses the same UNION SELECT mechanism but injects a PHP payload into a WordPress post. The injected PHP code: - Sets error_reporting(0) and ini_set('display_errors', 0) to suppress errors. - Requires a key parameter p matching the value 94uh9ubh6e1x to activate; otherwise returns a legitimate-looking HTTP 404 page. - Accepts commands via either a b parameter (base64-decoded using base64_decode, with the function name obfuscated via hex escapes: \x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65) or a c parameter (raw). - Attempts command execution via system() (hex-obfuscated as \x73\x79\x73\x74\x65\x6d), falling back to passthru() (hex-obfuscated as \x70\x61\x73\x73\x74\x68\x72\x75), then exec() (hex-obfuscated as \x65\x78\x65\x63). - Captures output via ob_start() / ob_get_clean().
5. Post-exploitation (observed by watchTowr): After successful exploitation, threat actors have been observed: - Exfiltrating hashed credentials. - Creating backdoor administrator accounts (watchTowr observed more than 100 backdoor accounts created by different threat actors using variations of public tooling). - Deploying fake WordPress plugins to achieve persistent RCE, exfiltrate credentials/secrets, or download additional tooling. - In at least one case, attempting to download Overlord RAT, a Golang-based remote access trojan.

Exploitation timeline

• 2026-07-17: WordPress released security updates and GitHub Security Advisories. Searchlight Cyber researcher Adam Kues published initial research (without technical specifics) and launched wp2shell.com checker. CVE-2026-60137 was discovered and disclosed by researchers TF1T, dtro, and haongo.
• 2026-07-17 (evening): PatchStack confirmed in-the-wild exploitation of both CVEs.
• 2026-07-18 (early hours): watchTowr reported successful exploitation was well underway, initially using public exploit code to exfiltrate hashed credentials, with RCE following once additional details became public.
• 2026-07-20: Searchlight Cyber published full technical breakdown. SANS ISC reported exploit attempts hitting honeypots. VulnCheck verified more than two dozen unique proof-of-concept exploits targeting wp2shell. ANSSI France (CERT-FR) published alert CERTFR-2026-ALE-007.
• 2026-07-21: Both CVEs added to CISA KEV.

Attribution

No named threat actor with a confirmed MITRE ATT&CK profile has been identified in the source material as responsible for the exploitation. watchTowr observed multiple distinct threat actors using variations of public exploit tooling. The reference to Overlord RAT is a single-sourced observation from watchTowr; attribution to any specific actor group is unconfirmed.

Confidence caveats

• The exploit payload details (webshell injection, command execution fallback chain) are corroborated by SANS ISC honeypot data and SecurityOnion capture (corpus-3), and are consistent with the attack chain described by Tenable (corpus-5) and The Register (corpus-4). Multi-source corroborated.
• The observation of Overlord RAT deployment is single-sourced to watchTowr via The Register (corpus-4). Verify before enforcement.
• The claim that AI models assisted threat actors in reproducing exploits is attributed to Jake Knott of watchTowr via The Register (corpus-4). This is an assessment, not a confirmed fact. Single-sourced; treat as unconfirmed.

4. Mitigation & containment

P1 — Within 24 hours

1. Patch all WordPress installations to the fixed version for their branch: - WordPress 6.9.x → upgrade to 6.9.5 - WordPress 7.0.x → upgrade to 7.0.2 - WordPress 7.1 Beta → upgrade to 7.1 Beta 2 - WordPress 6.8.x → upgrade to 6.8.6 (addresses CVE-2026-60137 standalone SQLi)

WordPress has enabled forced auto-updates for affected versions. Administrators should verify each internet-facing WordPress site has successfully upgraded — do not assume auto-update succeeded.

2. Inventory and enumerate: Identify all WordPress installations across the estate, including those managed by third parties, hosted on external providers, or used for internal purposes. Check each against the affected version ranges. Use the checker at https://wp2shell.com or authenticated vulnerability scans (Rapid7 InsightVM/Nexpose content release July 20, 2026 includes checks).
3. Assume compromise for unpatched internet-facing instances: If an affected WordPress installation has been internet-facing since 2026-07-17 and is not confirmed patched, treat it as potentially compromised. Perform forensic triage: - Review WordPress admin accounts for unauthorised additions (check wp_users table for accounts created after 2026-07-17). - Review installed plugins for suspicious or unrecognised additions (fake plugin directories). - Search for injected PHP payloads in post content (search wp_posts table for error_reporting, base64_decode, system, passthru, exec). - Check web server access logs for POST requests to /?rest_route=/batch/v1 or /wp-json/batch/v1 with User-Agent: cve-2026-63030/1.0 or similar. - Look for the webshell key 94uh9ubh6e1x in filesystem and database.
4. Block exploit traffic at WAF/reverse proxy: Block or rate-limit unauthenticated POST requests to /?rest_route=/batch/v1 and /wp-json/batch/v1 containing author_exclude parameters with SQL injection patterns (UNION SELECT, hex-encoded strings). If the REST API batch endpoint is not required, block it entirely for unauthenticated users.

P2 — Within 72 hours

1. Restrict REST API exposure: If the WordPress REST API is not required for site functionality, disable it or restrict access to authenticated users only. This can be achieved via: - .htaccess rules blocking /wp-json/ and /?rest_route= for unauthenticated requests. - Security plugins that restrict REST API access. - Reverse proxy rules.
2. Enable persistent object cache: Cloudflare confirmed the vulnerable code path is reached when a persistent object cache is not in use. Enable Redis or Memcached as a persistent object cache backend for WordPress. This is a mitigation, not a replacement for patching.
3. Audit WordPress admin accounts: Review all administrator-level accounts. Remove any unrecognised accounts. Reset passwords for all admin accounts on any instance that was vulnerable and internet-facing.
4. Scan for fake plugins: Inspect wp-content/plugins/ for directories that were not intentionally installed. Cross-reference against deployment records.
5. Hunt for webshell artefacts: Search the entire web root for PHP files containing the strings 94uh9ubh6e1x, error_reporting(0), or hex-obfuscated function calls matching the pattern \x73\x79\x73\x74\x65\x6d (system), \x70\x61\x73\x73\x74\x68\x72\x75 (passthru), \x65\x78\x65\x63 (exec).

P3 — Within 7 days

1. Verify auto-update success: For all WordPress instances with auto-updates enabled, confirm the version is now 6.9.5, 7.0.2, or later. Document verification.
2. Review hosting provider patches: If WordPress is managed by a hosting provider, confirm they have applied the fix. Some hosted installations receive patches automatically; self-managed installations require manual action.
3. Implement continuous WordPress monitoring: Deploy integrity monitoring for WordPress core files, plugin directories, and the wp_users table. Alert on unauthorised file additions or admin account creation.
4. Review CISA KEV remediation dates: CVE-2026-63030 has a CISA KEV due date of 2026-07-24. CVE-2026-60137 has a due date of 2026-08-04. While these are binding on US federal agencies, EMEA financial services should treat them as authoritative urgency indicators.

5. Indicators of compromise

useragent  cve-2026-63030/1.0
http_endpoint  POST /?rest_route=/batch/v1
http_endpoint  POST /wp-json/batch/v1
sqli_pattern  author_exclude=0) UNION SELECT
webshell_key  94uh9ubh6e1x
webshell_param  p
webshell_param  b
webshell_param  c
hex_obfuscated  \x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65
hex_obfuscated  \x73\x79\x73\x74\x65\x6d
hex_obfuscated  \x70\x61\x73\x73\x74\x68\x72\x75
hex_obfuscated  \x65\x78\x65\x63
sqli_marker  ||OK||
malware  Overlord RAT

Behavioural indicators

6. Detection

rule wp2shell_webshell_PHP {
  meta:
    author = "Adverse Trace"
    date = "2026-07-22"
    reference = "https://isc.sans.edu/diary/rss/33168"
    description = "Detects wp2shell injected PHP webshell payload with hex-obfuscated execution functions"
  strings:
    $key = "94uh9ubh6e1x"
    $b64 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65"
    $system = "\\x73\\x79\\x73\\x74\\x65\\x6d"
    $passthru = "\\x70\\x61\\x73\\x73\\x74\\x68\\x72\\x75"
    $exec = "\\x65\\x78\\x65\\x63"
    $err_rep = "error_reporting(0)"
    $ini_set = "ini_set(\\'display_errors\\',0)"
    $ob_start = "ob_start()"
    $ob_clean = "ob_get_clean()"
    $http404 = "404 Not Found"
    $param_p = "$_REQUEST[\"p\"]"
    $param_b = "$_REQUEST[\"b\"]"
    $param_c = "$_REQUEST[\"c\"]"
  condition:
    $key and ($err_rep or $ini_set) and 2 of ($b64, $system, $passthru, $exec) and ($ob_start or $ob_clean)
}

title: Detect wp2shell CVE-2026-63030 REST API Batch Exploitation
id: 7a3c1f2e-2026-0722-at366
status: experimental
description: Detects unauthenticated POST requests to WordPress REST API batch endpoint containing SQL injection patterns consistent with wp2shell exploit chain
author: Adverse Trace
date: 2026/07/22
references:

  - https://isc.sans.edu/diary/rss/33168
  - https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution
logsource:
  category: webserver
  product: apache/nginx/iis
detection:
  selection_endpoint:
    c-uri|contains:

      - "/?rest_route=/batch/v1"
      - "/wp-json/batch/v1"
    http_method: "POST"
  selection_sqli:
    c-uri|contains:

      - "author_exclude="
      - "UNION SELECT"
  selection_ua:
    user-agent|contains: "cve-2026-63030"
  condition: selection_endpoint and (selection_sqli or selection_ua)
fields:

  - src_ip
  - dst_ip
  - c-uri
  - user-agent
  - http_method
  - http_status
falsepositives:

  - Legitimate batch API usage with unusual query parameters (unlikely)
  - Security scanner testing for wp2shell vulnerability
level: critical

title: Detect wp2shell Webshell Access Pattern
id: 8b4d2g3f-2026-0722-at366
status: experimental
description: Detects HTTP requests consistent with wp2shell injected webshell accessing commands via p, b, or c parameters
author: Adverse Trace
date: 2026/07/22
references:

  - https://isc.sans.edu/diary/rss/33168
logsource:
  category: webserver
  product: apache/nginx/iis
detection:
  selection_key:
    c-uri|contains: "p=94uh9ubh6e1x"
  selection_params:
    c-uri|contains:

      - "&b="
      - "&c="
  condition: selection_key or (selection_key and selection_params)
fields:

  - src_ip
  - dst_ip
  - c-uri
  - http_status
  - user-agent
falsepositives:

  - Unlikely — key string is unique to this webshell
level: critical

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-63030 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-63030, 2026-07-21
• NVD, CVE-2026-60137 Detail, https://nvd.nist.gov/vuln/detail/CVE-2026-60137, 2026-07-21
• CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-63030 (added 2026-07-21, due 2026-07-24), https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-60137 (added 2026-07-21, due 2026-08-04), https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Rapid7, "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core", https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core, 2026-07-17
• SANS Internet Storm Center, "WordPress Exploitation Underway (CVE-2026-63030)", https://isc.sans.edu/diary/rss/33168, 2026-07-20
• The Register, "Attackers pummel critical WordPress vuln to create all sorts of mischief", https://www.theregister.com/security/2026/07/20/attackers-pummel-critical-wordpress-vuln-to-create-all-sorts-of-mischief/5275265, 2026-07-20
• Tenable Research, "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core", https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution, 2026-07-20
• ANSSI France CERT-FR, "Multiples vulnérabilités dans WordPress", https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/, 2026-07-20

8. Adverse Trace position

Severity: CRITICAL. CVE-2026-63030 (CVSS 9.8) is a confirmed unauthenticated RCE chain in WordPress Core — a product running approximately 40% of all websites. Both CVEs in the chain are in CISA KEV with active exploitation confirmed by multiple independent sources (SANS ISC, watchTowr, PatchStack, VulnCheck, Hexastrike). The attack requires no authentication, no plugins, and no user interaction; it works against default installations. Public proof-of-concept code is circulating, and VulnCheck has verified more than two dozen unique exploits. watchTowr has observed 100+ backdoor accounts created by multiple threat actors and at least one attempt to deploy Overlord RAT (single-sourced; verify before enforcement). EMEA financial services clients should treat any unpatched, internet-facing WordPress instance in the affected version range as presumptively compromised and initiate incident response procedures immediately. Adverse Trace is monitoring for additional threat actor tooling, new IOCs, and any confirmed attribution. We will issue updates if the threat landscape materially changes or if additional IOCs are corroborated.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.