CVE-2026-63030 Unauthenticated REST Batch Route Confusion

CVE-2026-63030 is a critical-severity vulnerability, listed in the CISA KEV catalog. AttackerView checks WordPress sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-63030?

Detects WordPress sites whose REST API batch endpoint executes one queued sub-request through a different sub-request's handler. The batch handler builds two lists side by side, one of the queued requests and one of the routes they resolved to, and when a request carries a path the URL parser rejects it reserves a slot in the first list but not in the second. Everything after that point is off by one, so a request addressed to one endpoint is run by the next endpoint's code, carrying values that were only ever checked against the schema of the endpoint it was addressed to. That is how unchecked input reaches a database query in the chained author_exclude flaw CVE-2026-60137, which NVD describes as the route to remote code execution. The check is two unauthenticated POSTs that differ by a single character: the first queues a well formed path and the second queues an unparseable one, and the finding is raised only when the second answers a queued request with the neighbouring route's result. Both probes end in permission denials, so nothing is created or changed. CVSS 9.8, CISA KEV with a three day federal remediation deadline. Upgrade WordPress to 7.0.2, 6.9.5, or 6.8.6 on the 6.8 branch.