WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route's input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server.
Browse WordPress security risksQuick answer
WordPress should be reviewed and updated if it matches the affected versions. The recommended fix is to apply the vendor-supported patched version or the mitigation steps below, then retest the public website with Fixnx.
Who is affected
Affected versions
- [6.9, 6.9.5)
- [7.0, 7.0.2)
Fixed versions
- 6.9.5
- 7.0.2
How to fix it
WordPress is affected by CVE-2026-63030, a remote code execution chain through REST API batch route confusion. An attacker can bypass batch-route checks, reach an unintended callback, and chain the flaw with SQL injection to run code. Update WordPress to 6.9.5, 7.0.2, or a newer vendor-supported patched release for the installed branch. Treat exposed production systems as an urgent patch and incident-review priority.
- Inventory every WordPress deployment, version, exposed endpoint, environment, and owner.
- Compare the installed release with the affected range recorded for this issue: [6.9, 6.9.5), [7.0, 7.0.2).
- Update WordPress to 6.9.5, 7.0.2, or a newer vendor-supported patched release for the installed branch.
- Immediately block /wp-json/batch/v1 at the edge until the WordPress update is complete.
- Review relevant logs and look for unusual nested batch POST requests, SQL payloads, changed PHP files, rogue administrators, cron persistence, and outbound connections.
- If exploitation is suspected, isolate the site, preserve evidence, restore or rebuild from a known-good source, and rotate all credentials, keys, tokens, and WordPress salts.
- Clear WordPress, object, page, CDN, and browser caches, then update the asset inventory and close any temporary controls only after validation.
Scan now. Google sign-in is only needed to unlock fix guidance.
Verify the fix
- Confirm WordPress is on the patched version or mitigation stated above and record the exact deployed version.
- Confirm the fixed WordPress release is installed and the batch route cannot dispatch a request to an unintended callback.
- Confirm the affected WordPress REST, AJAX, form, shortcode, upload, export, or admin feature is available only to the roles and requests that need it.
- Review logs after remediation for continued exploit attempts or signs that the issue was used before the fix.
- Rerun the relevant dependency, platform, vendor, or Fixnx security check and document the result, affected assets, change record, and cleanup evidence for CVE-2026-63030.
Related categories
Related security risks
More published guidance from the same primary category.
Trusted references
FAQ
What is affected by CVE-2026-63030?
WordPress versions listed as affected should be reviewed: [6.9, 6.9.5), [7.0, 7.0.2).
What should I fix first?
Start with internet-facing sites, admin panels, login flows, plugins, themes, modules, packages, and systems that process user-controlled input or sensitive data.
How do I confirm the fix worked?
Apply the patched version or mitigation, clear caches where relevant, retest the affected workflow, and run a new Fixnx scan to verify public website exposure signals.
How are Fixnx security risk categories chosen?
Fixnx keeps one canonical risk page and assigns only broad, relevant categories such as ecosystem, technology area, or vulnerability class.