BIT-WORDPRESS-2026-63030 WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 + CVE-2026-60137 — WP2Shell WordPress Core Pre-Au...

Exploit for CVE-2026-63030

CVE-2026-63030 — WordPress wp2shell Exploit Unauthenticated d...

Exploit for CVE-2026-60137

wp2shell-detect Blackbox, non-intrusive detector for wp...

wp2shell

wp2shell WordPress REST batch route-confusion blind SQL injec...

wp2shell

wp2shell-check Non-intrusive checker for CVE-2026-63030 /...

wp2shell-PoC

wp2shell — CVE-2026-63030 + CVE-2026-60137 WordPress Pre-Auth...

Exploit for CVE-2026-60137

wp2shell-lab Educational PoC and lab for CVE-2026-63030 + C...

Exploit for CVE-2026-63030

wp2shell CVE-2026-63030 + CVE-2026-60137: Independent Root C...

Exploit for CVE-2026-63030

WordPress REST API Batch Route Confusion + SQL Injection → RCE...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core

Overview On July 17, 2026, a GitHub Security Advisory was published for CVE-2026-63030, a critical unauthenticated remote code execution vulnerability affecting WordPress Core. While the official GitHub security advisory classifies the severity as Critical, the vulnerability has currently been...

Exploit for CVE-2026-63030

wp2shell-poc Proof-of-concept for an unauthenticated SQL inje...

DEBIAN-CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion

WordPress core 6.9.0 - 6.9.4 and 7.0.0 - 7.0.1 are affected by an unauthenticated SQL injection reachable through the REST API batch endpoint /batch/v1. The batch controller builds parallel $matches the matched handler per sub-request and $validation the validation result per sub-request arrays,...

PT-2026-60856

Name of the Vulnerable Software and Affected Versions WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1 Description A route confusion issue in the REST API batch endpoint, combined with a SQL injection in the WP Query class, allows a remote attacker to execute arbitrar...