CISA has added CVE-2026-63030, a critical (CVSS 9.8) interpretation-conflict vulnerability in WordPress Core, to its Known Exploited Vulnerabilities catalog, confirming active exploitation.
What Is It
CVE-2026-63030 is a REST API batch endpoint route confusion issue in WordPress Core (CWE-436, Interpretation Conflict). On its own it is a routing flaw, but when combined with the author__not_in WP_Query SQL Injection tracked as CVE-2026-60137, an attacker can perform SQL Injection and achieve Remote Code Execution. It carries a CVSS 3.1 base score of 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-exploitable, low complexity, and requiring no privileges or user interaction.
Why It Matters
CISA added this CVE to the KEV catalog on 2026-07-21, confirming it is under active exploitation. CISA's SSVC assessment rates exploitation as active, automatable, with total technical impact. Because the flaw needs no authentication and can be reached over the network, an attacker chaining it with CVE-2026-60137 can move from unauthenticated request to full remote code execution on an affected site.
What's Vulnerable
The vulnerability affects WordPress Core:
- WordPress 6.9.x before 6.9.5
- WordPress 7.0.x before 7.0.2
Patch Status
Fixed versions are available. Users should update to WordPress 6.9.5 or 7.0.2 per the vendor's WordPress 7.0.2 release. CISA's required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." Follow applicable BOD 26-04 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. The remediation due date is 2026-08-11.