WordPress Core flaws chain to unauthenticated RCE
Two combined WordPress Core vulnerabilities allow unauthenticated remote code execution, with a public PoC and mass exploitation expected.
On 17 July 2026, WordPress released patches for two vulnerabilities in WordPress Core: CVE-2026-60137, a SQL injection flaw, and CVE-2026-63030, a security policy bypass. Affecting versions 6.9.x and later, these two issues can be chained by an unauthenticated attacker to achieve remote code execution on affected sites. Given WordPress's massive install base as the world's most widely used CMS, this represents a significant attack surface.
French CERT-FR reports awareness of a public proof-of-concept exploit and anticipates mass exploitation attempts in the wild. Researchers at Searchlight Cyber, who discovered the vulnerabilities, recommend that administrators unable to immediately patch block unauthenticated access to the WordPress REST API, specifically cutting off requests to /wp-json/batch/v1 or those containing the rest_route=/batch/v1 parameter via a WAF, as a mitigation pending patch deployment.
CERT-FR strongly recommends applying the official vendor patches (WordPress 6.8.6, 6.9.5, 7.0.2, or 7.1 beta2 and later) as soon as possible. Organizations running self-hosted WordPress instances should treat this as an urgent patching priority given the combination of unauthenticated access, public exploit availability, and the CMS's ubiquity.
Mentioned in this report
Detection guidance
WordPress REST API Batch Endpoint Exploitation Attempt
Detects unauthenticated requests to the WordPress /wp-json/batch/v1 REST API endpoint or the rest_route=/batch/v1 parameter, the vector used to chain CVE-2026-60137 (SQLi) and CVE-2026-63030 (policy bypass) into unauthenticated RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WordPress REST API Batch Endpoint Exploitation Attempt
description: Detects requests targeting the WordPress core batch REST API route (/wp-json/batch/v1
or rest_route=/batch/v1 parameter), which is the exploitation vector for chaining
CVE-2026-60137 and CVE-2026-63030 into unauthenticated RCE. Generalises on the distinctive
endpoint path/parameter rather than any specific payload.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: /wp-json/batch/v1
selection_query:
cs-uri-query|contains: rest_route=/batch/v1
condition: selection_path or selection_query
falsepositives:
- Legitimate authenticated plugins or admin tooling that intentionally use the WordPress
batch REST endpoint for bulk operations
- Security scanners or vulnerability assessment tools probing for the presence of
the vulnerable endpoint
level: high
id: 8e45d8ce-a7ee-57a4-8a0c-f95b91624414
status: experimental
author: Vorant
Web Server Process Spawning Shell After Possible CMS RCE Exploitation
Detects a web server or PHP-FPM process spawning a command shell, consistent with post-exploitation code execution following a chained WordPress RCE such as CVE-2026-60137/CVE-2026-63030. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Shell After Possible CMS RCE Exploitation
description: Detects web server / PHP process (apache, nginx, php-fpm, w3wp.exe) spawning
a shell or interpreter, a common post-exploitation indicator when an unauthenticated
RCE chain (e.g. WordPress CVE-2026-60137/CVE-2026-63030) is successfully exploited
against a public-facing CMS.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \w3wp.exe
- \php-cgi.exe
- \php.exe
- \httpd.exe
- \nginx.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \wscript.exe
- \cscript.exe
- \bash.exe
filter_known_admin:
CommandLine|contains: C:\inetpub\wwwroot\wp-admin\install.php
condition: selection and not filter_known_admin
falsepositives:
- Legitimate PHP scripts intentionally shelling out to system utilities for site maintenance
(e.g. backup or cache-clearing plugins)
- Custom WordPress plugins that invoke command-line tools as part of normal operation
level: high
id: f79d73b7-0aea-568e-bbf1-0cc4813e9bf9
status: experimental
author: Vorant
WordPress Core Batch Endpoint Requests From Unauthenticated Sessions
Detects a burst pattern of requests to the WordPress batch REST route without an authenticated session cookie/header, indicative of mass scanning or exploitation attempts against the unauthenticated RCE chain; volume/frequency thresholds should be tuned and evaluated in the SIEM correlation layer rather than in this rule's condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WordPress Core Batch Endpoint Requests From Unauthenticated Sessions
description: Detects requests to the WordPress /wp-json/batch/v1 endpoint that lack
typical authenticated session indicators (no wordpress_logged_in cookie, no Authorization
header), matching the unauthenticated exploitation pattern described for CVE-2026-60137/CVE-2026-63030.
Because mass-exploitation attempts are expected per CERT-FR, analysts should additionally
alert on repeated hits from the same source within a short window using their SIEM's
aggregation capability rather than encoding a count threshold here.
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-stem|contains: /wp-json/batch/v1
filter_authenticated:
cs-cookie|contains: wordpress_logged_in_
condition: selection and not filter_authenticated
falsepositives:
- Authenticated integrations that omit the standard wordpress_logged_in cookie but
use valid application passwords or bearer tokens
- Reverse proxies or CDNs that strip cookie headers before logging, causing legitimate
authenticated traffic to appear unauthenticated
level: medium
id: 1ee66033-471b-525b-aa6b-2fb2f177113a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free