CVE-2026-63030
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
KEVCRITICAL 9.8EPSS 10.6%
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
- Affected
- WordPress
- CVSS v3.1 WPSCAN
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 10.65% chance of exploitation in the next 30 days, 96th percentile
- CISA KEV
- added 2026-07-21
- Nuclei
- critical · CWE-287
- Published
- 2026-07-17
- Updated
- 2026-10-07
Proof-of-concept exploits (68)
- Icex0/wp2shell-poc789★ · 2026-08-11
- mhtsec/CVE-2026-6303015★ · 2026-07-18
- attackercan/wp2shell-poc27★ · 2026-07-17
- ekomsSavior/wp2shell9★ · 2026-07-19
- mcipekci/wp2shell15★ · 2026-07-22
- 4minx/CVE-2026-6303010★ · 2026-07-18
- NULL200OK/WP2Shell17★ · 2026-07-18
- securelayer7/WordPresShell17★ · 2026-07-18
- c0gnit00/Wp2Shell1★ · 2026-07-19
- GhostInExile/CVE-2026-63030-Wp2Shell4★ · 2026-07-21
- mverschu/CVE-2026-630305★ · 2026-07-18
- Crypto-Cat/wp2shell3★ · 2026-07-20
- JohenLastGen-JLG/wp2shell2★ · 2026-07-18
- 4B3R4M4-607D/CVE-2026-63030-POC2★ · 2026-07-19
- Ch4120N/CVE-2026-630302★ · 2026-07-20
- johnlodan/wp2shell-rce3★ · 2026-08-04
- yuag/wp2shell0★ · 2026-07-27
- gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc0★ · 2026-07-22
- Giangdurian/CVE-2026-63030-CVE-2026-601370★ · 2026-07-24
- 0xBlackash/CVE-2026-630301★ · 2026-07-18
- Iqbalx7/wp2shell0★ · 2026-07-20
- shinthink/CVE-2026-630300★ · 2026-07-24
- CybersecSpirit/CVE-2026-630300★ · 2026-07-18
- gbrsh/CVE-2026-630301★ · 2026-07-18
- administrator-01001/CVE-2026-630301★ · 2026-07-20
- zeroc00I/CVE-2026-630300★ · 2026-07-18
- joaovicdev/EXPLOIT-CVE-2026-630301★ · 2026-07-20
- TomorrowX6/CVE-2026-63030-poc0★ · 2026-09-09
- mrx-arafat/CVE-2026-63030-POC0★ · 2026-07-18
- Industri4l-H3ll-Xpl0it3rs/CVE-2026-63030-WP2Shell0★ · 2026-07-30
- lucifer0xf/wp2shell-Wordpress-TOWN2★ · 2026-07-20
- razureink/cve-2026-63030_60137-wordpress_rce_reproduction0★ · 2026-07-23
- Bhanunamikaze/WP2Shell-CVE-2026-63030-POC0★ · 2026-07-21
- tcyph3r/wp2shell-cve-2026-63030-root-cause0★ · 2026-07-19
- 0xWhoknows/wp2shell1★ · 2026-07-18
- raphy76/wp2shell-poc-fulljs0★ · 2026-07-23
- h4cd0c/wp2shell0★ · 2026-07-18
- TranDongA3/POC-CVE-2026-63030-CVE-2026-60137-0★ · 2026-08-19
- Procjevt/CVE-2026-630300★ · 2026-08-03
- AnggaTechI/CVE-2026-630301★ · 2026-08-08
- x-znn/CVE-2026-630300★ · 2026-08-04
- DeadExpl0it/wp2shell-poc3★ · 2026-08-21
- ThomasNJordan/wp2shell3★ · 2026-07-18
- allannjuguna/Wp2Shell0★ · 2026-07-20
- interim-embryoniccell971/wp2shell-Exploit-Waf-Bypass1★ · 2026-10-13
- GMJayy/wp-cve-poc4★ · 2026-08-27
- Ka01nq/WpScc2★ · 2026-10-08
- sahmsec/wp2shell1★ · 2026-08-28
- 0xh7ml/CVE-2026-630300★ · 2026-07-19
- 0xsha/wp2shell115★ · 2026-07-18
- ChiefYoru/CVE-2026-63030_PoC0★ · 2026-07-18
- J4ck3LSyN-Gen2/CVE-2026-63030-wp2r00t6★ · 2026-07-18
- Senanfurkan/wordpress-cve-2026-630305★ · 2026-07-18
- Dungsocool/CVE-2026-60137_CVE-2026-630300★ · 2026-07-27
- b1bek/wp2shell0★ · 2026-07-19
- codeb0ssx/Ultimate-wp2shell10★ · 2026-07-18
- edenzaraf/wp2shell5★ · 2026-07-19
- ivanesk315/CVE-2026-60137-and-CVE-2026-630300★ · 2026-09-10
- fl0ydsec/CVE-2026-630300★ · 2026-10-12
- z3rodayhacks/CVE-2026-63030-CVE-2026-601370★ · 2026-08-07
- langz337/CVE-2026-630301★ · 2026-09-26
- jed-parsec/CVE-2026-63030-60137-wp2shell-lab1★ · 2026-09-27
- MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137-0★ · 2026-09-29
- pedroMPMartins/wordpress_exploit0★ · 2026-10-01
- hitechcloud-vietnam/wp2shell-PoC0★ · 2026-10-03
- theendofabbys/wp2shell-rce0★ · 2026-10-08
- 0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL0★ · 2026-10-12
- gichirimaku/wp2shell-PoC
Nuclei templates (1)
Metasploit modules (1)
Vulhub environments (1)
Security advisories
- WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release