Loading vulnerability…
CVE-2026-63030 is a critical unauthenticated remote code execution vulnerability in WordPress Core affecting versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1. The issue is described as a REST API batch endpoint route confusion flaw that can be combined with the author__not_in WP_Query SQL injection vulnerability tracked as CVE-2026-60137. The vulnerable code path is reportedly reachable through the WordPress REST API batch endpoint on default installations and is specifically noted to be exploitable when a persistent object cache is not in use. No authentication or user interaction is required. Successful exploitation can lead from route confusion and SQL injection conditions to arbitrary code execution in the context of the affected WordPress environment, enabling full compromise of the site and associated data.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No valid public exploits. Mallory filtered out 4 candidates as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote code execution vulnerability in WordPress core caused by REST API batch request route/validation desynchronization, allowing a validated sub-request to be dispatched to an unintended callback and chained with SQL injection.
A critical unauthenticated remote code execution vulnerability in WordPress REST API batch endpoint affecting WordPress 6.9 and later when a persistent object cache is not in use.
A critical unauthenticated remote code execution vulnerability in WordPress Core reachable via the WordPress REST API batch endpoint, potentially allowing complete compromise of affected websites and underlying data.
An unauthenticated remote code execution vulnerability in the WordPress core REST API batch endpoint. It is tied to a route confusion condition that can be chained with CVE-2026-60137 to achieve RCE, particularly when a persistent object cache is not enabled.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.