# WordPress Core flaws chain to unauthenticated RCE

Published: 2026-07-20 · Severity: high
Canonical: https://vorant.io/reports/26b95a7c-b59e-5f74-8e8d-6c834e39f78b/wordpress-core-flaws-chain-to-unauthenticated-rce

> Two combined WordPress Core vulnerabilities allow unauthenticated remote code execution, with a public PoC and mass exploitation expected.

On 17 July 2026, WordPress released patches for two vulnerabilities in WordPress Core: CVE-2026-60137, a SQL injection flaw, and CVE-2026-63030, a security policy bypass. Affecting versions 6.9.x and later, these two issues can be chained by an unauthenticated attacker to achieve remote code execution on affected sites. Given WordPress's massive install base as the world's most widely used CMS, this represents a significant attack surface.

French CERT-FR reports awareness of a public proof-of-concept exploit and anticipates mass exploitation attempts in the wild. Researchers at Searchlight Cyber, who discovered the vulnerabilities, recommend that administrators unable to immediately patch block unauthenticated access to the WordPress REST API, specifically cutting off requests to /wp-json/batch/v1 or those containing the rest_route=/batch/v1 parameter via a WAF, as a mitigation pending patch deployment.

CERT-FR strongly recommends applying the official vendor patches (WordPress 6.8.6, 6.9.5, 7.0.2, or 7.1 beta2 and later) as soon as possible. Organizations running self-hosted WordPress instances should treat this as an urgent patching priority given the combination of unauthenticated access, public exploit availability, and the CMS's ubiquity.

## Mentioned in this report

- Vulnerabilities: CVE-2026-60137 (KEV), CVE-2026-63030 (KEV)

## Detection guidance (public sample)

### WordPress REST API Batch Endpoint Exploitation Attempt

ATT&CK: T1190

Detects unauthenticated requests to the WordPress /wp-json/batch/v1 REST API endpoint or the rest_route=/batch/v1 parameter, the vector used to chain CVE-2026-60137 (SQLi) and CVE-2026-63030 (policy bypass) into unauthenticated RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WordPress REST API Batch Endpoint Exploitation Attempt
description: Detects requests targeting the WordPress core batch REST API route (/wp-json/batch/v1
  or rest_route=/batch/v1 parameter), which is the exploitation vector for chaining
  CVE-2026-60137 and CVE-2026-63030 into unauthenticated RCE. Generalises on the distinctive
  endpoint path/parameter rather than any specific payload.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains: /wp-json/batch/v1
  selection_query:
    cs-uri-query|contains: rest_route=/batch/v1
  condition: selection_path or selection_query
falsepositives:
- Legitimate authenticated plugins or admin tooling that intentionally use the WordPress
  batch REST endpoint for bulk operations
- Security scanners or vulnerability assessment tools probing for the presence of
  the vulnerable endpoint
level: high
id: 8e45d8ce-a7ee-57a4-8a0c-f95b91624414
status: experimental
author: Vorant
```

### Web Server Process Spawning Shell After Possible CMS RCE Exploitation

ATT&CK: T1190

Detects a web server or PHP-FPM process spawning a command shell, consistent with post-exploitation code execution following a chained WordPress RCE such as CVE-2026-60137/CVE-2026-63030. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Web Server Process Spawning Shell After Possible CMS RCE Exploitation
description: Detects web server / PHP process (apache, nginx, php-fpm, w3wp.exe) spawning
  a shell or interpreter, a common post-exploitation indicator when an unauthenticated
  RCE chain (e.g. WordPress CVE-2026-60137/CVE-2026-63030) is successfully exploited
  against a public-facing CMS.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \w3wp.exe
    - \php-cgi.exe
    - \php.exe
    - \httpd.exe
    - \nginx.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \wscript.exe
    - \cscript.exe
    - \bash.exe
  filter_known_admin:
    CommandLine|contains: C:\inetpub\wwwroot\wp-admin\install.php
  condition: selection and not filter_known_admin
falsepositives:
- Legitimate PHP scripts intentionally shelling out to system utilities for site maintenance
  (e.g. backup or cache-clearing plugins)
- Custom WordPress plugins that invoke command-line tools as part of normal operation
level: high
id: f79d73b7-0aea-568e-bbf1-0cc4813e9bf9
status: experimental
author: Vorant
```

### WordPress Core Batch Endpoint Requests From Unauthenticated Sessions

ATT&CK: T1190

Detects a burst pattern of requests to the WordPress batch REST route without an authenticated session cookie/header, indicative of mass scanning or exploitation attempts against the unauthenticated RCE chain; volume/frequency thresholds should be tuned and evaluated in the SIEM correlation layer rather than in this rule's condition. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: WordPress Core Batch Endpoint Requests From Unauthenticated Sessions
description: Detects requests to the WordPress /wp-json/batch/v1 endpoint that lack
  typical authenticated session indicators (no wordpress_logged_in cookie, no Authorization
  header), matching the unauthenticated exploitation pattern described for CVE-2026-60137/CVE-2026-63030.
  Because mass-exploitation attempts are expected per CERT-FR, analysts should additionally
  alert on repeated hits from the same source within a short window using their SIEM's
  aggregation capability rather than encoding a count threshold here.
tags:
- attack.initial_access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: /wp-json/batch/v1
  filter_authenticated:
    cs-cookie|contains: wordpress_logged_in_
  condition: selection and not filter_authenticated
falsepositives:
- Authenticated integrations that omit the standard wordpress_logged_in cookie but
  use valid application passwords or bearer tokens
- Reverse proxies or CDNs that strip cookie headers before logging, causing legitimate
  authenticated traffic to appear unauthenticated
level: medium
id: 1ee66033-471b-525b-aa6b-2fb2f177113a
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/26b95a7c-b59e-5f74-8e8d-6c834e39f78b/wordpress-core-flaws-chain-to-unauthenticated-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup