WordPress Core Vulnerability: Working Exploit Released
CVE-2026-63030 exposes pre-auth RCE risk in WordPress versions, urgent updates required.
1Critical WordPress Vulnerability
CVE-2026-63030 identifies a WordPress core security flaw allowing authentication bypass through REST API batch-route confusion. This initiates an exploit chain enabling unauthorized system access.
2Public Exploit Availability
A working MIT-licensed exploit is now public on GitHub with educational use disclaimer. Shared on Telegram channels with target scanning dorks, its free distribution increases widespread risk.
3Vulnerability Chain Details
Post auth-bypass, SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) enables database dumping. Cracked admin hashes lead to RCE via theme editor in default WordPress installations.
4Affected Versions
Versions 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to RCE chain. SQLi impacts 6.8.x series. Security patches released in 7.0.2, 6.9.5 and 6.8.6. Auto-updates protect active installations.
5Immediate Action Required
With public exploit availability, automated scanning of exposed WordPress sites is expected. Experts warn unpatched systems may already be compromised through prior vulnerabilities.
6Cybersecurity Alert
Security teams recommend checking logs for new uploads directory files, modified PHP, and unauthorized admin accounts. Manual installations without auto-updates require emergency patching.