|
Information Security Advisory
A recently discovered vulnerability (CVE-2026-63030) that affects WordPress Core and allow an unauthenticated remote attacker to achieve remote code execution (RCE).
Severity level:
CVSS Score: 9.8/Critical.
Description:
WordPress is one of the most widely deployed content management systems, making vulnerabilities in its core software potentially significant for organizations operating public-facing websites. CVE-2026-63030 is a critical REST API batch endpoint route confusion vulnerability in WordPress Core. The flaw causes a mismatch between request validation and execution within the WordPress REST API batch processing mechanism, allowing specially crafted requests to bypass expected security controls. When chained with CVE-2026-60137, an SQL injection vulnerability in WP_Query, an unauthenticated attacker can achieve remote code execution and fully compromise a vulnerable WordPress site.
Affected Versions:
- WordPress 6.9.0 through 6.9.4
- WordPress 7.0 through 7.0.1
- WordPress 7.1 beta releases prior to 7.1 beta 2
Impact:
Successful exploitation may allow attackers to execute arbitrary code on the affected server.
Resolution:
Upgrade affected WordPress installations to:-
- WordPress 6.9.5 or later.
- WordPress 7.0.2 or later.
- WordPress 7.1 beta 2 or later.
Reference:
https://www.cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723
https://nvd.nist.gov/vuln/detail/CVE-2026-63030
https://www.tenable.com/cve/CVE-2026-63030
https://www.bleepingcomputer.com/news/security/wordpress-core-wp2shell-rce-flaws-get-public-exploits-patch-now/
UIT Information Security
Contact
IT Client Services at askIT@yorku.ca or 416 736 5800
|
