Urgent WordPress Security Advisory: Critical RCE Chain Exploited In The Wild (CVE-2026-63030 & CVE-2026-60137)

By Staff Writer

Urgent WordPress Security Advisory: Critical RCE Chain Exploited In The Wild (CVE-2026-63030 & CVE-2026-60137)

A pair of severe vulnerabilities within WordPress, designated CVE-2026-63030 and CVE-2026-60137, demand immediate attention from all administrators. Combined, these flaws permit unauthenticated attackers to execute arbitrary code on affected sites, essentially granting them full control. Proof-of-Concept (PoC) exploit code is publicly available, and reports indicate active exploitation in the wild, underscoring the urgency for patching.

Unpacking the Vulnerabilities: Batch-Route Confusion and SQL Injection

Understanding the mechanism of these vulnerabilities is crucial for grasping their destructive potential. This isn’t just about a single flaw; it’s a chain reaction.

CVE-2026-63030: The Unauthenticated Gateway

Discovered by Adam Kues at Assetnote and Searchlight Cyber, CVE-2026-63030 is an unauthenticated batch-route confusion vulnerability. Simply put, this flaw allows attackers to bypass authentication checks that would normally protect certain API endpoints. The WordPress REST API includes a “batch” endpoint designed to handle multiple API requests efficiently. This vulnerability confuses the system regarding the authentication status of requests routed through this batch handler, thereby enabling unauthorized access to actions typically reserved for authenticated users. Cloudflare’s advisory specifically notes that this can lead to pre-authentication RCE when a persistent object cache is not in use, a common configuration for many WordPress installations.

CVE-2026-60137: The SQL Injection Lever

Independently identified by the TF1T, dtro, and haongo team, CVE-2026-60137 is an authenticated SQL injection vulnerability. On its own, this flaw requires an attacker to already possess valid user credentials to exploit. SQL injection permits an attacker to insert malicious SQL code into input fields, manipulating the database queries. This can lead to unauthorized data retrieval, modification, or even deletion, including sensitive information like user credentials.

The Dangerous Exploit Chain: From Bypass to Total Control

Here’s the thing: while CVE-2026-60137 is an authenticated vulnerability, CVE-2026-63030 changes everything. The batch-route confusion acts as an authentication bypass. This means an unauthenticated attacker can leverage CVE-2026-63030 to effectively “authenticate” to the system, thereby unlocking the SQL injection vulnerability, CVE-2026-60137, which would otherwise be inaccessible. Once the SQL injection is exploitable, attackers can:

• Dump the entire WordPress database, including password hashes for all users.
• Crack these password hashes to obtain plaintext administrative credentials.
• Log in as an administrator.
• Utilize the theme and plugin editor functionalities, which are available to administrators, to upload and execute arbitrary PHP code. This culminates in a full Remote Code Execution (RCE) on the server.

This entire process, from initial unauthenticated access to full server compromise, has a low barrier to entry thanks to readily available PoC exploits on platforms like GitHub. Early exploitation attempts have already been observed, making swift action paramount.

Affected WordPress Versions and Essential Patches

The severity of this exploit chain necessitates immediate patching. Several WordPress versions are at risk:

• WordPress 6.9: Vulnerable to both CVE-2026-63030 and CVE-2026-60137. Administrators must update to WordPress 6.9.5 immediately.
• WordPress 6.8: Primarily affected by CVE-2026-60137. Update to WordPress 6.8.6 to apply the fix. While 6.8 is not directly vulnerable to the batch-route confusion, upgrading to the latest secure branch is always prudent.
• WordPress 7.1 Beta: Both vulnerabilities affect early beta releases. WordPress 7.1 Beta 2 contains the necessary patches.

Notably, versions of WordPress prior to 6.8 are not susceptible to these specific issues. However, running older, unsupported WordPress versions is a significant security risk in itself and should be avoided.

Emergency Mitigation Strategies (Temporary)

If patching isn’t immediately feasible, temporary mitigation measures can reduce exposure, though they are not long-term solutions and may cause functional disruptions. Searchlight Cyber security researchers suggest:

• WAF (Web Application Firewall) Rules: Block requests to /wp-json/batch/v1 and ?rest_route=/batch/v1 at the WAF level. This directly targets the batch-route confusion vector.
• REST API Blocking Plugin: Install a WordPress plugin designed to block anonymous access to the REST API entirely. Be aware, this might break legitimate functionalities relying on the REST API.

These are strictly emergency steps. Prioritize a full update as soon as humanly possible.

Beyond the Patch: Proactive Security Measures

While patching these critical flaws is non-negotiable, it also serves as a stark reminder of the continuous need for robust cybersecurity hygiene. Consider these proactive steps to enhance your WordPress security service:

• Regular Updates: Keep WordPress core, themes, and plugins updated. Many vulnerabilities stem from outdated software.
• Security Audits: Periodically conduct or commission security audits of your WordPress installation and underlying server infrastructure.
• Strong Access Controls: Implement strong, unique passwords for all users, especially administrators. Enforce two-factor authentication (2FA) for every login.
• Least Privilege Principle: Grant users only the minimum necessary permissions to perform their tasks. Avoid giving editor or administrator roles to those who don’t absolutely need them.
• Hardening WordPress: Implement additional security measures like disabling file editing from the dashboard, restricting file permissions, and using security plugins that offer extra layers of protection.
• Reliable Backups: Maintain regular, off-site backups of your entire WordPress installation, including the database and files. Test restoration procedures periodically.
• Incident Response Plan: Have a clear plan for what to do if your site is compromised. Knowing who to contact and what steps to take can minimize damage. Even experienced organizations, like the US cybersecurity agency CISA, had to build their incident playbook during an incident, illustrating how critical preparation is.
• Logging and Monitoring: Implement comprehensive logging and monitor these logs for suspicious activities. Early detection can prevent full compromise.

Conclusion

The confluence of CVE-2026-63030 and CVE-2026-60137 presents an exceptionally dangerous threat to WordPress sites. The ability for an unauthenticated attacker to achieve Remote Code Execution is among the most severe outcomes in web security. Given the active exploitation and public availability of PoC code, deferring action is not an option. Patch your WordPress installations to the recommended versions immediately. Beyond this critical fix, recommit to a holistic and proactive approach to your website security. Your diligence now will prevent significant headaches and potential damage down the line.