CVE-2026-63030 CISA KEV · Actively exploitedSuited to automated attack · CISA
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
CVSS score
9.8
EPSS probability
%10.6
Risk score
2.1
Published
3 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
Nuclei: WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion
Makefile Go / Python
Similar Vulnerabilities
8.1
CVE-2026-87902 Actively exploited
Vulnerability in WordPress
W
Workaround Public Exploits:7EPSS %40
5.9
CVE-2026-60137 Actively exploited
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
W
WorkaroundEPSS %5
8.8
CVE-2026-65640
Unrestricted file upload in WordPress
W
Patch status unknown Public Exploits:2EPSS %2
8.9
CVE-2026-64638
Cross-site scripting in WordPress
W
Patch status unknown Public Exploits:9EPSS %1
4.3
CVE-2023-39999
WordPress < 6.3.2 is vulnerable to Broken Access Control
W
Patch verifiedEPSS %1
-
CVE-2019-9978 Actively exploited
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
W
Workaround Public Exploits:11EPSS %73
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-63030"