1. Executive summary
CVE-2026-63030 is a critical unauthenticated remote code execution (RCE) vulnerability in WordPress Core, exploitable via the WordPress REST API batch endpoint. The vulnerability affects WordPress versions 6.9.0–6.9.4 and 7.0.0–7.0.1, and is fixed in 6.9.5, 7.0.2, and 7.1 Beta 2. Per the verified reference data, this CVE carries a CVSS score of 9.8 (CRITICAL) and is not currently listed in CISA KEV (EPSS 9%). Note: the Rapid7 source text references a lower CVSS of 7.5 attributed to the GitHub advisory at time of publication; we assess the vulnerability at the verified NVD CVSS 9.8. The attack path requires no authentication and no additional plugins, and can be reached on default installations when a persistent object cache is not in use. Public exploit code has been released (BleepingComputer), and EMEA financial services organisations running public-facing WordPress sites should treat this as an immediate patching priority.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 24: digital operational resilience testing — general requirements | Unauthenticated RCE in internet-facing WordPress Core with public exploit code available creates a concrete, testable exposure for financial entities' public web presence. | Clients must include CVE-2026-63030 in vulnerability scanning and operational resilience testing of internet-facing assets; verify patch deployment across all WordPress instances. |
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Public exploit availability and the potential for complete website compromise via an unauthenticated path may meet the classification threshold for a major ICT-related incident if exploitation is detected. | Clients must be prepared to classify and report any confirmed exploitation to competent authorities within DORA's incident reporting timelines. |
3. Technical analysis & attack chain
Vulnerability mechanism. CVE-2026-63030 is an unauthenticated remote code execution vulnerability in WordPress Core, exploitable through the WordPress REST API batch endpoint. The vulnerability class is CWE-436 per the verified reference data. The vulnerable code path can be reached when a persistent object cache is not in use, as reported by Cloudflare. Searchlight Cyber (whose researchers identified the vulnerability, with attribution reported by Adam Kues at Assetnote / Searchlight Cyber) stated that exploitation is possible against a default WordPress installation without requiring additional plugins.
Affected versions
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0.0 through 7.0.1
- WordPress 7.1 beta versions (not fully specified)
Fixed versions
- WordPress 6.9.5 (fixes 6.9 branch)
- WordPress 7.0.2 (fixes 7.0 branch)
- WordPress 7.1 Beta 2 (fixes 7.1 beta branch)
WordPress versions earlier than 6.9 are not affected by this CVE.
Attack chain (confirmed steps)
- Reconnaissance. Attacker identifies an internet-facing WordPress installation running an affected version (6.9.0–6.9.4 or 7.0.0–7.0.1) without a persistent object cache configured.
- Initial access. Attacker sends a crafted request to the WordPress REST API batch endpoint. No valid account credentials or user interaction are required.
- Code execution. The vulnerability allows the attacker to execute arbitrary code on the server underlying the WordPress installation, potentially resulting in complete compromise of the website and its data.
Exploitation status. As of the Rapid7 publication (July 17, 2026, 5:45 PM ET), Rapid7 was not aware of publicly confirmed in-the-wild exploitation. However, BleepingComputer subsequently reported that public exploits have been released. This is a corroborated, multi-source fact (Rapid7 + BleepingComputer). The CVE is not currently listed in CISA KEV.
Confidence caveat. Technical exploit details had not been published by Searchlight Cyber as of the Rapid7 publication timestamp. The specific payload mechanism, persistence techniques, and post-exploitation behaviour are not described in the available source material. Rapid7 Labs assessed it as "highly likely" that a public PoC would be made available quickly given WordPress Core is open-source and amenable to AI-assisted code analysis. BleepingComputer's report confirms this assessment.
Related CVE. The WordPress 7.0.2 security release also addresses CVE-2026-60137, a REST API batch-route confusion and SQL injection issue. The Help Net Security source contains a likely typo listing the same CVE identifier twice; the second entry describes a distinct SQL injection issue reported by TF1T, dtro, and haongo. This advisory focuses on CVE-2026-63030 only.
4. Mitigation & containment
P1 — Within 24 hours
- Patch all internet-facing WordPress installations. Upgrade affected versions immediately:
- WordPress 6.9.0–6.9.4 → upgrade to 6.9.5
- WordPress 7.0.0–7.0.1 → upgrade to 7.0.2
- WordPress 7.1 beta → upgrade to 7.1 Beta 2
- WordPress maintainers are forcing updates for installations with automatic updates enabled. Administrators must nevertheless verify that each internet-facing site has successfully upgraded — do not assume auto-update succeeded.
- Identify all WordPress instances across the estate, including those managed by third parties or marketing departments, that may not be covered by central patching processes.
P2 — Within 72 hours
- Enable a persistent object cache (e.g., Redis, Memcached) on WordPress installations where feasible. Cloudflare reported that the vulnerable code path can be reached when a persistent object cache is not in use. This is a risk-reduction measure, not a substitute for patching.
- Deploy WAF rules to restrict or monitor access to the WordPress REST API batch endpoint (
/wp-json/wp/v2/batch routes) where business requirements allow. This may reduce exposure to exploit attempts but should not be relied upon as a primary control. - Run authenticated vulnerability scans against all WordPress assets. Rapid7 InsightVM, Nexpose, and Exposure Command customers can assess exposure using authenticated checks available in the July 20, 2026 content release.
P3 — Within 7 days
- Review WordPress auto-update configuration across all instances to ensure future security releases are applied promptly.
- Audit WordPress installations for the presence of additional vulnerable plugins referenced in recent GitHub Security Advisories (Premmerce Dev Tools ≤2.0, FileOrganizer <1.2.0, UpdraftPlus ≤1.26.4) — these represent separate but related RCE risks.
- Establish or update asset inventory to ensure all WordPress instances, including those on staging/development environments, are tracked and included in vulnerability management cycles.
Workarounds. WordPress has not recommended workarounds. Patching is the only effective remediation.
5. Indicators of compromise
No indicators of compromise available in the source material.
The sources do not provide specific atomic IOCs (IPs, domains, hashes, file paths, or command-line artefacts) associated with exploitation of CVE-2026-63030. Technical exploit details had not been published by Searchlight Cyber as of the Rapid7 publication, and the BleepingComputer report does not include specific IOCs.
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
Unauthenticated POST requests to WordPress REST API batch endpoint (/wp-json/ batch routes) |
Web server access logs, WAF logs, CDN logs (e.g., Cloudflare) | Medium — based on confirmed attack vector; specific payload patterns not yet published |
| Unexpected PHP process execution originating from the web server (www-data or equivalent service account) | EDR, host process monitoring, auditd | Low — generic RCE indicator; no specific payload artefacts available |
New or modified files in wp-content/ directory without corresponding legitimate admin activity |
File integrity monitoring, EDR filesystem rules | Low — generic post-exploitation indicator; no specific filenames available |
6. Detection
Insufficient indicators to author detection rules.
The source material does not contain specific threat artefacts (strings, file hashes, mutex names, scheduled task names, registry keys, or hard-coded values) that would enable a reliable YARA or Sigma rule. The vulnerability is exploited via the REST API batch endpoint, but no distinctive payload strings, parameter names, or request body patterns have been published. Generic detection for "requests to the WordPress REST API" would generate excessive false positives and is not recommended as a YARA or Sigma rule.
Recommended detection approach (narrative): Monitor web server and WAF logs for unauthenticated requests to WordPress REST API batch endpoints. Correlate with subsequent anomalous process execution or file creation activity on the web server host. Deploy EDR rules to alert on PHP child processes spawned by the web server service that are not associated with known legitimate WordPress cron or plugin operations.
CVE assessment
1 referenced CVE — 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-63030 | 9.8 Critical | — | 9% | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combi… |
7. Sources
- Rapid7, "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core," https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core, published 2026-07-17.
- BleepingComputer, "WordPress Core 'wp2shell' RCE flaws get public exploits, patch now," https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/, published 2026-07-18.
- Help Net Security, "Two new high severity WordPress vulnerabilities, patch immediately!," https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/, published 2026-07-18.
8. Adverse Trace position
CVE-2026-63030 is a CVSS 9.8 CRITICAL unauthenticated RCE in WordPress Core with public exploit code now available. The attack path requires no credentials, no user interaction, and no additional plugins — default installations without a persistent object cache are vulnerable. EMEA financial services organisations with any internet-facing WordPress presence should treat this as a P1 patching emergency: upgrade to 6.9.5 or 7.0.2 immediately and verify auto-update success rather than assuming it. The absence of confirmed in-the-wild exploitation at time of Rapid7's publication is no longer a reliable risk indicator given BleepingComputer's report of public exploit release. We assess the risk to EMEA financial services as HIGH given the prevalence of WordPress in marketing sites, customer portals, and blog infrastructure that may sit outside core IT patching cycles. Adverse Trace will monitor for IOCs, exploit payloads, and any confirmed exploitation activity, and will issue an update if CISA KEV inclusion occurs or if sector-specific targeting is observed.
Published via PulseTrace — Adverse Trace threat intelligence.