# CVE-2026-63030: WordPress WP2Shell - SQLi

> Live exploitation tracking for CVE-2026-63030 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-63030

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** WordPress
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

## CrowdSec analysis

[CVE-2026-63030](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-63030) is a critical WordPress REST API batch endpoint route confusion vulnerability affecting versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2. When combined with the author__not_in WP_Query SQL injection flaw (CVE-2026-60137), unauthenticated remote attackers could execute SQL injection attacks and potentially achieve remote code execution, compromising data confidentiality, integrity, and system availability.

CrowdSec has been tracking this vulnerability and its exploits since 20th of July 2026.

Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2026-63030 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2026-63030. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Attackers target the WordPress REST batch endpoint `/?rest_route=/batch/v1` with nested batch requests that attempt to bypass authentication and reach `/wp/v2/categories`. The `author_exclude` parameter contains conditional `SLEEP()` SQL injection payloads, with response delays used as a timing oracle to extract database contents.

## Timeline

- 2026-07-17: CVE Published. CVE-2026-63030 is published to NVD.
- 2026-07-20: Rule Released. CrowdSec releases a rule to detect CVE-2026-63030 exploitation attempts against the CrowdSec Network.
- 2026-07-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-63030 for the first time.
- 2026-07-21: CISA KEV. CVE-2026-63030 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-07-24: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-63030.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-63030) follows observed exploitation activity for CVE-2026-63030. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.