# WordPress Core Vulnerability: Working Exploit Released CVE-2026-63030 exposes pre-auth RCE risk in WordPress versions, urgent updates required. - **Source:** [Technical Information Security Content & Discussion](https://brifing.si/source/00707f34-d14e-4e4d-a6f0-2cd451bd38f7) - **Published:** 2026-07-19 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/0747e814-04ef-46e3-baab-9fc54c37d58d ## Critical WordPress Vulnerability CVE-2026-63030 identifies a WordPress core security flaw allowing authentication bypass through REST API batch-route confusion. This initiates an exploit chain enabling unauthorized system access. ## Public Exploit Availability A working MIT-licensed exploit is now public on GitHub with educational use disclaimer. Shared on Telegram channels with target scanning dorks, its free distribution increases widespread risk. ## Vulnerability Chain Details Post auth-bypass, SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137) enables database dumping. Cracked admin hashes lead to RCE via theme editor in default WordPress installations. ## Affected Versions Versions 6.9.0–6.9.4 and 7.0.0–7.0.1 are vulnerable to RCE chain. SQLi impacts 6.8.x series. Security patches released in 7.0.2, 6.9.5 and 6.8.6. Auto-updates protect active installations. ## Immediate Action Required With public exploit availability, automated scanning of exposed WordPress sites is expected. Experts warn unpatched systems may already be compromised through prior vulnerabilities. ## Cybersecurity Alert Security teams recommend checking logs for new uploads directory files, modified PHP, and unauthorized admin accounts. Manual installations without auto-updates require emergency patching. ## Sources covering this story - https://www.reddit.com/r/netsec/comments/1v0kvve/wp2shell_cve202663030_update_public_working/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._