> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th) - URL: https://f4n6.co.uk/security-feed/wordpress-exploitation-underway-cve-2026-63030-mon-jul-20th/ - Published: 2026-07-20T22:00:12.000Z - Updated: 2026-07-20T22:00:12.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-63030 ## 1\. Executive summary CVE-2026-63030 (CVSS 9.8 CRITICAL, CWE-436) is an unauthenticated remote code execution vulnerability in WordPress Core, exploited via the REST API batch endpoint. Active in-the-wild exploitation is confirmed by multiple sources (SANS ISC, Tenable, SecurityWeek, BleepingComputer) within days of the July 17 2026 disclosure, with public proof-of-concept exploits circulating. The flaw affects WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixed in 6.9.5 and 7.0.2\. EMEA financial services running self-managed WordPress installations for public-facing websites, blogs, or portals face immediate risk of complete server compromise, webshell deployment, and database tampering. The vulnerability is NOT currently listed in CISA KEV (EPSS 9%). Note: Rapid7's advisory quotes a CVSS of 7.5; the authoritative NVD record assigns 9.8 CRITICAL — we use the verified 9.8 throughout. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19 | Active in-the-wild exploitation of a CVSS 9.8 unauthenticated RCE in WordPress Core with confirmed webshell deployment and admin-user creation constitutes a potentially major ICT-related incident if a financial entity's internet-facing WordPress installation is compromised. | Entities with affected WordPress installations must assess whether the incident meets the classification threshold for reporting to competent authorities under DORA Art. 18/19. | | DORA Art. 24 | The vulnerability affects WordPress Core (a widely deployed ICT asset) with public PoC available and confirmed exploitation — requiring urgent testing of internet-facing installations for exposure. | Entities must verify all WordPress installations are patched to 6.9.5/7.0.2 and conduct retrospective compromise checks as part of digital operational resilience testing. | No NIS2 or UK NIS articles are specifically engaged beyond generic incident-response obligations, as no supply-chain-specific or third-party-specific trigger facts are present in this item. ## 3\. Technical analysis & attack chain **Affected versions:** WordPress 6.9.0–6.9.4, 7.0.0–7.0.1\. Fixed in 6.9.5, 7.0.2, and 7.1 Beta 2\. Versions prior to 6.9 are NOT affected by CVE-2026-63030 (introduced in 6.9). **Chained CVE:** CVE-2026-60137 (CVSS 5.9) — SQL injection in the `author__not_in` parameter of `WP_Query`, present in WordPress 6.8.0+. When chained with CVE-2026-63030 (REST API batch-route confusion), the two flaws enable unauthenticated pre-auth RCE. CVE-2026-63030 was introduced in WordPress 6.9, so the full RCE chain is only achievable on 6.9.x and 7.0.x. CVE-2026-60137 was discovered by researchers TF1T, dtro, and haongo; CVE-2026-63030 was discovered by Adam Kues of Searchlight Cyber. No MITRE ATT&CK actor profiles are associated with the exploitation at this time — attribution is unconfirmed. **Precondition:** The WordPress REST API must be exposed. Cloudflare reports the vulnerable code path is reached when a persistent object cache is NOT in use. No plugins or themes are required — default WordPress configuration is exploitable. ### Confirmed attack chain (from SANS ISC captured exploit) 1. **Initial access — REST API batch endpoint.** Attacker sends `POST /?rest_route=/batch/v1` (or `/wp-json/batch/v1`) with `Content-Type: application/json` and `User-Agent: cve-2026-63030/1.0`. The batch request nests a sub-request targeting `/wp/v2/posts`. 2. **SQL injection via `author_exclude` parameter.** The batch route confusion (CVE-2026-63030) allows the attacker to reach the `WP_Query` SQL injection (CVE-2026-60137) through the `author_exclude` parameter on `/wp/v2/posts/999999`. The injected SQL uses `UNION SELECT` to break out of the original query: `author_exclude=0) UNION SELECT 999999,2,0x323032302d30312d30312030303a30303a3030,...,0x706f7374,22,23-- +-` 3. **Vulnerability detection probe.** The first UNION SELECT returns `||OK||` (hex-encoded `0x4f4b` wrapped in `0x7c7c` delimiters) to confirm SQL injection is working. Hex values decode to standard WordPress post fields (e.g., `0x7075626c697368` \= `publish`, `0x706f7374` \= `post`, `0x323032302d30312d30312030303a30303a3030` \= `2020-01-01 00:00:00`). 4. **Webshell deployment via `INTO OUTFILE`.** The second injected query writes a PHP webshell to disk: `sql UNION SELECT '' INTO OUTFILE '/var/www/wp-content/cache/94uh9ubh6e1x.php'` 5. **Webshell capabilities.** The dropped file (`94uh9ubh6e1x.php`) is a command-execution webshell with the following characteristics: - **Authentication key:** Requires `?p=94uh9ubh6e1x` parameter; returns a fake HTTP 404 page if the key is absent or incorrect ("Jedi error" — the page exists but returns 404). - **Command delivery:** Accepts commands via `?b=` (base64-decoded using `base64_decode`, hex-obfuscated as `\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65`) or `?c=` (plaintext). - **Execution functions (fallback chain):** `system()` → `passthru()` → `exec()` → `shell_exec()` → `popen()` → backtick operator. Each is checked via `function_exists()` for PHP hardening bypass. - **Output wrapping:** Command output is delimited by `[S]` and `[E]` markers. If no command is provided, returns `[S]OK[E]`. 6. **Post-exploitation — admin user creation.** The attacker subsequently created a new admin user in the WordPress database (confirmed by SANS ISC reader submission). **Exploitation scope:** Honeypot detections began over the weekend of July 18–19\. Hexastrike has assisted with incident response in several confirmed attacks. Patchstack has confirmed in-the-wild exploitation. Public PoC exploits are circulating (BleepingComputer, Tenable). ANSSI France (CERT-FR) issued alert CERTFR-2026-ALE-007 on July 20. **Single-sourced detail:** The complete exploit payload and webshell analysis are sourced solely from the SANS ISC diary (one reader-submitted SecurityOnion capture). The webshell filename `94uh9ubh6e1x.php` and key `94uh9ubh6e1x` are from this single capture — verify before enforcement, as other actors may use different filenames/keys. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Patch immediately.** Upgrade all internet-facing WordPress installations to 6.9.5 (6.9 branch) or 7.0.2 (7.0 branch). Verify that automatic updates have applied successfully — do not assume. WordPress is forcing updates for installations with auto-updates enabled, but self-managed installations require manual action. - **Check for compromise** on any installation running 6.9.0–6.9.4 or 7.0.0–7.0.1 that had the REST API exposed between July 17 and patch date: - Inspect `/var/www/wp-content/cache/` (and any WordPress `cache` directory) for unexpected `.php` files. Remove any files not associated with legitimate caching plugins. - Query the WordPress database for recently created admin users: `SELECT user_login, user_registered FROM wp_users WHERE user_registered > '2026-07-17' ORDER BY user_registered DESC;` - Review web server access logs for `POST` requests to `/?rest_route=/batch/v1` or `/wp-json/batch/v1` with `User-Agent: cve-2026-63030/1.0`. - Review logs for SQL injection patterns in `author_exclude` or `author__not_in` parameters containing `UNION SELECT` and `INTO OUTFILE`. ### P2 — Within 72 hours - **Block the exploit vector at WAF/reverse proxy** for any installation that cannot be immediately patched: - Block or rate-limit requests to `/wp-json/batch/v1` and `/?rest_route=/batch/v1` from untrusted sources. - Block requests with `User-Agent: cve-2026-63030/1.0`. - Block SQL injection signatures matching `UNION SELECT ... INTO OUTFILE` in REST API parameters. - **Disable REST API** if not required for business functionality (note: this may break plugins/themes that depend on it). - **Enable a persistent object cache** (e.g., Redis, Memcached) — Cloudflare reports the vulnerable code path is reached when a persistent object cache is NOT in use. This is a mitigation, not a replacement for patching. - **Harden PHP** by disabling `system`, `passthru`, `exec`, `shell_exec`, `popen` via `php.ini` `disable_functions` where web application functionality permits. ### P3 — Within 7 days - **Asset inventory validation.** Enumerate all WordPress installations across the organisation, including those managed by third-party hosting providers, marketing teams, or business units. Confirm patch status for each. - **File integrity monitoring.** Deploy FIM on WordPress `wp-content/cache/`, `wp-content/uploads/`, and theme/plugin directories to alert on new `.php` file creation. - **Tabletop / purple-team exercise.** Validate detection coverage for the SQLi-to-webshell pattern (REST API → UNION SELECT → INTO OUTFILE → webshell with 404 facade). ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | --------------- | ---------------------------------------------------------- | ----------------------- | ------------------ | | filepath | /var/www/wp-content/cache/94uh9ubh6e1x.php | Medium (single-sourced) | SANS ISC | | user-agent | cve-2026-63030/1.0 | High | SANS ISC | | http-path | /?rest\_route=/batch/v1 | High | SANS ISC | | http-path | /wp-json/batch/v1 | High | Tenable / SANS ISC | | sql-pattern | UNION SELECT ... INTO OUTFILE in author\_exclude parameter | High | SANS ISC | | webshell-key | 94uh9ubh6e1x | Medium (single-sourced) | SANS ISC | | webshell-marker | \[S\] / \[E\] output delimiters | Medium (single-sourced) | SANS ISC | ```iocs filepath /var/www/wp-content/cache/94uh9ubh6e1x.php user-agent cve-2026-63030/1.0 http-path /?rest_route=/batch/v1 http-path /wp-json/batch/v1 webshell-key 94uh9ubh6e1x ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ---------- | | POST requests to REST API batch endpoint with nested /wp/v2/posts sub-requests containing UNION SELECT in author\_exclude | Web server access logs, WAF logs, SIEM | High | | New .php files appearing in wp-content/cache/ directory | File integrity monitoring, EDR, filesystem audit | High | | PHP webshell returning HTTP 404 status code but serving content when correct ?p= key parameter is supplied | Web server access logs (200/404 anomaly), WAF, EDR | Medium | | Recently created admin users in WordPress database after July 17, 2026 | WordPress database, authentication logs | High | | Outbound HTTP connections from web server process following REST API exploitation | Network firewall, NDR, SIEM | Medium | ## 6\. Detection ```yara rule wp2shell_webshell_94uh9ubh6e1x { meta: author = "Adverse Trace" date = "2026-07-20" reference = "https://isc.sans.edu/diary/rss/33168" description = "Detects wp2shell webshell dropped via CVE-2026-63030 exploit chain" strings: $key = "94uh9ubh6e1x" ascii $marker_s = "[S]" ascii $marker_e = "[E]" ascii $func_check = "function_exists" ascii $obf_base64 = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65" ascii $obf_system = "\\x73\\x79\\x73\\x74\\x65\\x6d" ascii $obf_passthru = "\\x70\\x61\\x73\\x73\\x74\\x68\\x72\\x75" ascii $obf_exec = "\\x65\\x78\\x65\\x63" ascii $obf_shell_exec = "\\x73\\x68\\x65\\x6c\\x6c\\x5f\\x65\\x78\\x65\\x63" ascii $obf_popen = "\\x70\\x6f\\x70\\x65\\x6e" ascii $http404 = "404 Not Found" ascii $ini_display = "display_errors" ascii condition: $key and 2 of ($marker_s, $marker_e) and $func_check and 3 of ($obf_*) and $http404 } ``` ```yaml title: Detect wp2shell REST API Batch Endpoint Exploitation CVE-2026-63030 id: 7a3c1f2e-2026-0720-4470-b3a1-9c8e5d4f2a01 status: experimental description: Detects exploitation attempts targeting WordPress REST API batch endpoint with SQL injection patterns characteristic of CVE-2026-63030 author: Adverse Trace date: 2026/07/20 references: - https://isc.sans.edu/diary/rss/33168 logsource: category: webserver product: apache detection: selection_endpoint: c-uri|contains: - "/?rest_route=/batch/v1" - "/wp-json/batch/v1" selection_ua: c-user-agent|contains: - "cve-2026-63030/1.0" selection_sqli: c-uri|contains: - "UNION" - "INTO OUTFILE" - "author_exclude=" condition: selection_endpoint and (selection_ua or selection_sqli) falsepositives: - Legitimate batch API usage with unusual user agents (unlikely) - Security scanning tools testing for CVE-2026-63030 level: critical ``` ```yaml title: Detect wp2shell Webshell Creation in WordPress Cache Directory id: 8b4d2e3f-2026-0720-5581-c4b2-0d9f6e5g3b12 status: experimental description: Detects creation of PHP files in WordPress wp-content/cache directory, consistent with wp2shell webshell deployment via INTO OUTFILE author: Adverse Trace date: 2026/07/20 references: - https://isc.sans.edu/diary/rss/33168 logsource: category: file_event product: linux detection: selection_path: TargetFilename|contains: - "/wp-content/cache/" selection_ext: TargetFilename|endswith: - ".php" condition: selection_path and selection_ext falsepositives: - Legitimate caching plugins writing PHP files to cache directory (verify against known plugin behaviour) level: high ``` ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-63030](https://nvd.nist.gov/vuln/detail/CVE-2026-63030?ref=f4n6.co.uk) | 9.8 Critical | — | 9% | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combi… | ## 7\. Sources - SANS ISC — "WordPress Exploitation Underway (CVE-2026-63030)" — https://isc.sans.edu/diary/rss/33168 — 2026-07-20 - Tenable Research — "wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core" — https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution — 2026-07-20 - Rapid7 — "CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core" — https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core — 2026-07-17 - BleepingComputer — "WordPress Core 'wp2shell' RCE flaws get public exploits, patch now" — https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/ — 2026-07-20 - Help Net Security — "Two new high severity WordPress vulnerabilities, patch immediately!" — https://www.helpnetsecurity.com/2026/07/18/wordpress-vulnerabilities-wp2shell-cve-2026-60137-cve-2026-60137/ — 2026-07-18 - SecurityWeek — "WP2Shell WordPress Vulnerabilities Exploited in the Wild" — https://www.securityweek.com/wp2shell-wordpress-vulnerabilities-exploited-in-the-wild/ — 2026-07-20 - ANSSI France CERT — "Multiples vulnérabilités dans WordPress (20 juillet 2026)" — https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/ — 2026-07-20 ## 8\. Adverse Trace position **Severity: CRITICAL.** CVE-2026-63030 (CVSS 9.8, CWE-436) is a pre-authentication RCE in WordPress Core — not a plugin — affecting default installations with no preconditions beyond REST API exposure. Active exploitation is multi-source corroborated (SANS ISC, Tenable, SecurityWeek, BleepingComputer, Patchstack, Hexastrike) with public PoC code circulating. The exploit chain is reliable, requires no authentication, and delivers a functional webshell with command execution and database manipulation capabilities. The Rapid7 advisory quotes CVSS 7.5; the authoritative NVD record assigns 9.8 CRITICAL — we assess at 9.8 per the verified reference data. The vulnerability is NOT in CISA KEV as of this advisory (EPSS 9%), though given the exploitation trajectory, KEV addition is likely. Attribution to any named threat actor is unconfirmed — no MITRE ATT&CK actor profiles are associated. The complete exploit payload and webshell IOC set are single-sourced from one SANS ISC reader submission; clients should treat the specific filename (`94uh9ubh6e1x.php`) and key (`94uh9ubh6e1x`) as representative, not exhaustive — other actors will use different values. **Client impact:** Any EMEA financial services organisation running self-managed WordPress 6.9.x–7.0.1 with internet-facing REST API exposure should treat this as an active incident — patch to 6.9.5/7.0.2 immediately and conduct retrospective compromise checks. Hosted/managed WordPress installations may have been auto-patched by providers; verify. **Next steps:** Adverse Trace will monitor for CISA KEV addition, track additional webshell variants as they emerge, and update IOCs as exploitation broadens beyond the initial single-sourced capture. --- [Read the original source →](https://isc.sans.edu/diary/rss/33168?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*