WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

Exploited in the wild. Listed by CISA on 2026-07-21; known to be used by ransomware.

criticalseverity

9.8CVSS score

10.6%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint (/?rest_route=/batch/v1). A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach unintended REST API handlers and bypass authorization checks. This route confusion can be chained with a SQL injection flaw (CVE-2026-60137) in the author_exclude parameter to extract database contents and ultimately achieve remote code execution. This template safely detects the vulnerable handler state via the route confusion behavior alone, without executing SQL or relying on response timing.

Impact

The route confusion allows unauthenticated requests to reach REST API handlers they should not be able to access. When chained with the associated SQL injection, an unauthenticated attacker can read the entire WordPress database (including user credential hashes) and escalate to full site compromise and remote code execution.

Fix

Update WordPress immediately to version 6.9.5 or 7.0.2. As a temporary mitigation, block POST requests to /wp-json/batch/v1 and /?rest_route=/batch/v1 at the WAF or reverse proxy level.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains(body, "wp-content") || contains(body, "wp-includes") || contains(tolower(header), "rest_route") || contains(tolower(header), "wp-json")
Send: POST /?rest_route=/batch/v1
Positive when: contains "parse_path_failed" and "block_cannot_read" and "rest_batch_not_allowed" AND contains in content_type "application/json" AND status 207

Run it with nuclei: nuclei -id CVE-2026-63030 -u <target>

The full check

id: CVE-2026-63030

info:
  name: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
  author: slcyber,mielverkerken,pdteam,flx-0x00
  severity: critical
  description: |
    WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint (/?rest_route=/batch/v1). A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach unintended REST API handlers and bypass authorization checks. This route confusion can be chained with a SQL injection flaw (CVE-2026-60137) in the author_exclude parameter to extract database contents and ultimately achieve remote code execution. This template safely detects the vulnerable handler state via the route confusion behavior alone, without executing SQL or relying on response timing.
  impact: |
    The route confusion allows unauthenticated requests to reach REST API handlers they should not be able to access. When chained with the associated SQL injection, an unauthenticated attacker can read the entire WordPress database (including user credential hashes) and escalate to full site compromise and remote code execution.
  remediation: |
    Update WordPress immediately to version 6.9.5 or 7.0.2. As a temporary mitigation, block POST requests to /wp-json/batch/v1 and /?rest_route=/batch/v1 at the WAF or reverse proxy level.
  reference:
    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
    - https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core
    - https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell
    - https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
    - https://github.com/sergiointel/wp2shell-poc/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-63030
    epss-score: 0.10649
    epss-percentile: 0.95836
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 2
    vendor: wordpress
    product: wordpress
    framework: wordpress
    shodan-query: http.component:"wordpress"
    fofa-query: app="WordPress"
  tags: cve,cve2026,wordpress,wp-core,preauth,batch-api,route-confusion,vkev,kev

flow: http(1) && http(2)

http:
  # Step 1: Confirm the target is a WordPress site before probing the batch endpoint
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "wp-content") || contains(body, "wp-includes") || contains(tolower(header), "rest_route") || contains(tolower(header), "wp-json")'
        internal: true

  # Step 2: Safe route-confusion detection (no SQL execution, no timing oracle)
  - raw:
      - |
        POST /?rest_route=/batch/v1 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"requests":[{"method":"POST","path":"///"},{"method":"POST","path":"/wp/v2/posts"},{"method":"POST","path":"/wp/v2/block-renderer/core/archives"},{"method":"POST","path":"/batch/v1","body":{"requests":[]}}]}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "parse_path_failed"
          - "block_cannot_read"
          - "rest_batch_not_allowed"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"

      - type: status
        status:
          - 207

References

Use this check only on systems you are authorised to test. Where the data comes from