WordPress WP2Shell - SQLi (CVE-2026-63030)

CVE-2026-63030 is a critical WordPress REST API batch endpoint route confusion vulnerability affecting versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2. When combined with the author__not_in WP_Query SQL injection flaw (CVE-2026-60137), unauthenticated remote attackers could execute SQL injection attacks and potentially achieve remote code execution, compromising data confidentiality, integrity, and system availability.

CrowdSec has been tracking this vulnerability and its exploits since 20th of July 2026.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2026-63030 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-63030. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers target the WordPress REST batch endpoint /?rest_route=/batch/v1 with nested batch requests that attempt to bypass authentication and reach /wp/v2/categories. The author_exclude parameter contains conditional SLEEP() SQL injection payloads, with response delays used as a timing oracle to extract database contents.