CVE-2026-63030 affects multiple versions of the system, and has prompted emergency updates and urgent firewall workarounds for websites.
Researchers recently found a vulnerability in a commonly used open source content management system, whereby an unauthenticated attacker could seize control of a site running on that system, with a single request.
The vulnerability, now registered as CVE-2026-63030, combines a REST API batch request route confusion problem with SQL injection, creating a path to remote code execution without a login, special configuration, or any plugin dependency. The issue affects WordPress 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1.
A separate but less severe SQL injection flaw, CVE-2026-60137, impacts WordPress system versions 6.8 onward.
Subsequently, WordPress.org released a fix on 17 July, 2026. Before that, the firm had publicly disclosed the problem, facilitating efforts to put web application firewall defenses in place at 17:03 UTC.
About the critical vulnerability
With WordPress powering an estimated 40% of websites, even a short delay in patching can leave a vast number of sites exposed.
According to sources, the platform’s remote code execution path is exploitable when persistent object caching is not enabled, which covers many standard WordPress deployments. The issue is the “highest-severity, highest-priority class of issue.”
To protect users, WordPress.org has since turned on forced automatic updates for affected installations, although sites with auto-updates disabled or setups managed through version control may not receive the fix automatically.
Administrators who cannot patch right away are being urged to block both the /wp-json/batch/v1 endpoint and the query-string variant ?rest_route=/batch/v1 at the web application firewall layer. Blocking only the pretty permalink version is not enough, because the alternate route remains exposed.
The episode also shows the tension at the heart of open source security. Once a fix is published, defenders can study it immediately, but so can attackers looking for the same weakness, which is why researchers warned that for core remote code execution bugs, hours matter more than days.
