CRITICAL CISA KEV

CVE-2026-63030

CVSS v3

9.8

CRITICAL

EPSS Score

8.9%

exploit probability

CISA KEV

Yes

known exploited

Exploitation

SSVC status

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CISA Known Exploited Vulnerability

Date Added
7/21/2026
Patch Due Date
7/24/2026
Ransomware Use
Unknown

Technical details

CVSS v3 Vector
3.1
Published
7/17/2026
Last Modified
7/18/2026
CERT-FR Advisory
CERTFR-2026-ALE-007

Frequently asked questions

What is CVE-2026-63030?

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Is CVE-2026-63030 actively exploited?

Yes. CVE-2026-63030 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, meaning it has been confirmed as actively exploited in the wild. CISA requires federal agencies to patch by 7/24/2026.

What is the CVSS score for CVE-2026-63030?

CVE-2026-63030 has a CVSS v3 base score of 9.8 (CRITICAL severity), with vector string 3.1.

Is CVE-2026-63030 affecting your environment?

Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.