WordPress Core RCE Vulnerability CVE-2026-63030 Added to CISA Known Exploited Vulnerabilities Catalog

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-63030, a WordPress core remote code execution vulnerability, to its Known Exploited Vulnerabilities catalog following active exploitation against versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, according to security guidance published August 5 by Infordisa's Security Operations Center.

The vulnerability carries a 9.8 CVSS rating and requires neither authentication nor user interaction, enabling attackers to take complete control of affected WordPress installations through network-based exploitation. Infordisa reported that automated scanning from thousands of distinct IP addresses has targeted small businesses, online stores, and technology companies indiscriminately since the first attacks were detected shortly after public disclosure in mid-July 2026.

The flaw exists in WordPress core functionality that ships with every default installation, distinguishing it from the plugin and theme vulnerabilities that typically dominate WordPress security advisories. WordPress patched the vulnerability in versions 6.9.5 and 7.0.2; versions prior to 6.9.0 remain unaffected. The security firm noted that public exploits were released for the wp2shell vulnerability chain shortly after disclosure.

Technical Mechanism Behind wp2shell Exploitation

CVE-2026-63030 chains two separate flaws to achieve remote code execution. The first component is a logic error in WordPress's batch request processing endpoint at /wp-json/batch/v1, which validates and executes API requests in separate loops, causing a desynchronization between validation and execution stages.

The second component is a SQL injection vulnerability in the author__not_in parameter. By combining both flaws in a single batch request, attackers can inject and execute arbitrary SQL commands that escalate to operating system command execution on the underlying server.

The Infordisa analysis emphasized the vulnerability's high confidentiality, integrity, and availability impact scores. Successful exploitation allows attackers to read or modify site content, install persistent backdoors, extract customer data, or use compromised servers as launching points for additional attacks against other systems.

Exploitation Timeline and Attack Volume

Attackers began probing for vulnerable WordPress installations within days of the mid-July 2026 public disclosure, according to Infordisa's threat monitoring. The rapid weaponization mirrors patterns observed in previous WordPress plugin exploits, where automated scanning typically begins within hours of vulnerability publication.

CISA's addition of CVE-2026-63030 to the KEV catalog signals that federal agencies must patch affected systems within prescribed timelines and that private sector organizations face elevated risk from the vulnerability. Compromised WordPress sites are now delivering credential phishing, malware, and fraudulent redirects to ordinary visitors, according to separate Malwarebytes research published in late July 2026.

The Infordisa report documented scanning activity targeting diverse verticals without sector-specific focus, suggesting opportunistic exploitation rather than targeted campaigns. Attack tools testing for wp2shell vulnerabilities now circulate on penetration testing forums and underground marketplaces.

Immediate Mitigation Requirements

Organizations running WordPress 6.9.0 through 6.9.4 or 7.0.0 through 7.0.1 must upgrade to versions 6.9.5 or 7.0.2 immediately, Infordisa stated. The security firm noted that updating WordPress represents the only complete remediation for the vulnerability.

For environments where immediate patching is not feasible, Infordisa recommended installing the "Disable WP REST API" plugin to prevent unauthenticated users from accessing REST API endpoints. As a temporary supplementary measure, administrators should configure web application firewalls to block requests to /wp-json/batch/v1 and any requests containing the rest_route=/batch/v1 parameter.

The security guidance advised reviewing server access logs for anomalous activity patterns, particularly POST requests to batch API endpoints from unusual source addresses. Organizations should inventory all WordPress installations across their infrastructure to identify and prioritize patching for affected versions.

Infordisa's Security Operations Center noted that a public testing tool at wp2shell.com allows organizations to check whether specific WordPress installations remain vulnerable to CVE-2026-63030 exploitation.

Agencies Implications

Digital agencies managing white-label WordPress installations or client sites must treat CVE-2026-63030 patching as an immediate client communication and liability exposure issue. The vulnerability's presence in WordPress core rather than third-party plugins means every agency-managed site running versions 6.9.x or 7.0.0-7.0.1 requires urgent remediation, regardless of plugin selection or hosting configuration. Agencies should audit their entire client portfolio for affected versions today and establish a documented patching timeline to demonstrate due diligence if client sites are compromised before updates are applied.

The wp2shell case reinforces why agencies increasingly turn to white-label WordPress partners with dedicated security operations teams rather than managing dozens of client sites with in-house capacity. A single critical core vulnerability requiring emergency weekend patching across 50 client sites consumes operations bandwidth that many agencies lack, particularly when clients demand immediate confirmation of their protection status. Partners who maintain production debugging and monitoring infrastructure can execute coordinated patches without client-facing downtime.

The rapid exploitation timeline—attacks began within days of disclosure—illustrates the compressed window between vulnerability publication and active compromise. Agencies should implement automated WordPress version monitoring and establish pre-authorized emergency patching protocols with clients, allowing security updates to deploy without waiting for approval cycles. The alternative is explaining to clients why their sites were compromised through a known, patched vulnerability while update requests sat in approval queues.