CVE-2026-63030
A flaw in the WordPress REST API allows for route confusion, which can be combined with a separate SQL injection vulnerability. This combination allows an attacker to execute malicious commands on the server.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Users running WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2.
Real-world impact
An attacker could gain full control over the website by executing arbitrary code on the server, potentially leading to complete system compromise.
Why this severity
The critical score reflects that the vulnerability can be exploited remotely over the network without any user interaction or special privileges, resulting in total loss of confidentiality, integrity, and availability.
What to do about it
- 01Update WordPress to version 6.9.5 or 7.0.2 or later.
NVD description
Timeline
- Jul 17, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 10d agoConfirmed exploited (CISA KEV)CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
- Jul 22, 2026 · 8d agoAdvisory updatedThe NVD record was last revised.
- Jul 24, 2026 · 7d agoCISA remediation deadlineFederal agencies are required to remediate by this date.
How it’s attacked
References & advisories
- github.com/WordPress/wordpress-develop…vendor advisory
- wordpress.org/news/2026/07/wordpress-7-0-…release notes
- cisa.gov/known-exploited-vulnerabili…us government resource