The CrowdSec Network is watching a fast-growing wave of attacks on CVE-2026-63030, a critical flaw in WordPress core. An unauthenticated attacker can chain a REST API weakness to a SQL injection bug, read your database, and eventually take over the server behind it. The community is already calling it “WP2Shell,” and it went from first detection to internet-wide scanning in three days.
Key findings
- Published July 17, detected and exploited from July 20: CVE-2026-63030 was published to NVD on July 17, 2026. CrowdSec released a detection rule on July 20 and saw the first in-the-wild exploitation the same day. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on July 21, with a federal remediation deadline of July 24. That KEV listing is a clear sign the attacks are real and widespread.
- Critical severity with a public exploit: The flaw carries a CVSS 9.8 rating, and both a working proof-of-concept and a public Nuclei detection template are already circulating, which puts exploitation within reach of low-skill, automated attackers.
- Rapid Escalation phase: Within days of the first detection, CVE-2026-63030’s exploitation phase climbed from “Insufficient Data” to “Early Exploitation” to “Rapid Escalation” on the CrowdSec Network, with thousands of unique IP addresses worldwide probing for exposed sites. “Rapid Escalation” is the fastest-moving category we track, reserved for recent flaws under strong and still-growing attacker interest.
What is WordPress?
WordPress is the world’s most widely used content management system (CMS). By common estimates, it runs more than a third of all websites, from personal blogs to online stores and company sites. It is usually looked after by marketers, small-business owners, agencies, and developers, often without a dedicated security team watching over it.
Why it matters: This is a flaw in WordPress core, not an optional plugin. Every site running an affected version (6.9.x before 6.9.5, or 7.0.x before 7.0.2) is exposed straight out of the box, with no unusual add-on required. Because the bug leads from SQL injection to remote code execution, a successful attack can hand over the whole site and the server behind it: stolen customer data and password hashes, defacement, hidden backdoors, spam and malware redirects, or a foothold to move deeper into your network. With WordPress’s enormous footprint, attackers can scan the entire internet and still land on millions of live targets.
How does CVE-2026-63030 work?
CVE-2026-63030 is a classic exploit chain: two smaller weaknesses combined into one critical break-in (CWE-89, SQL injection).
The entry point is the WordPress REST API batch endpoint, /?rest_route=/batch/v1. A route confusion bug lets an unauthenticated attacker wrap nested requests that slip past authentication and reach the /wp/v2/categories route. That route is backed by a separate SQL injection flaw in how WP_Query handles the author__not_in parameter (tracked as CVE-2026-60137). Attackers plant conditional SLEEP() statements in the author_exclude parameter and watch how long the server takes to answer. That “timing oracle” lets them read the database one answer at a time, pulling out usernames, password hashes, and secrets before pivoting to remote code execution.
Official advisory: WordPress Security Advisory GHSA-ff9f-jf42-662q
Fixed release: WordPress 7.0.2 release notes
Detection template: ProjectDiscovery Nuclei Template
Threat Landscape Analysis
CrowdSec has been tracking CVE-2026-63030 since our rule went live on July 20, 2026. In its first days on our network, the vulnerability moved quickly through our exploitation phases, from “Insufficient Data” to “Early Exploitation” and then to “Rapid Escalation,” with thousands of unique IP addresses joining the attack. That final label is the signal that matters here: we reserve it for recent vulnerabilities showing strong and still-increasing attacker interest, and CVE-2026-63030 earned it within days of the first observed attack.
Almost all of this activity is opportunistic. Attackers scan the internet indiscriminately with automated tooling and make no effort to pick specific victims. If your site is online and unpatched, it will be found. The dominant goal we see is infrastructure takeover, well ahead of data theft or ransomware, which points to a “grab as many servers as possible” land grab rather than a targeted heist. The attacking IPs are spread across many countries, led by the United States and Iran, while the sites getting hit skew toward small businesses, e-commerce, and technology firms, the usual WordPress crowd. The surprising part isn’t who gets targeted but how fast it moved: going from first sighting to full Rapid Escalation in a matter of days leaves almost no room to react after the fact.
How to protect your systems
- Patch: Update WordPress immediately. The fixes ship in WordPress 7.0.2 and 6.9.5; anything on 7.0.x before 7.0.2 or 6.9.x before 6.9.5 is vulnerable. If you rely on auto-updates, confirm they actually applied, and don’t forget managed hosts and staging copies. See the WordPress 7.0.2 release notes and the official security advisory. Patching is the only complete fix.
- Preemptive blocking: Put the CrowdSec WAF in front of your WordPress sites to filter malicious REST API requests, and subscribe to the CrowdSec Intelligence Blocklists to pre-emptively drop traffic from the thousands of IPs already attacking our network.
- Stay proactive: For instant monitoring of how this CVE evolves, follow the CrowdSec Live Exploit Tracker for CVE-2026-63030.
Unsure about where to start? Check out our special 3-minute introduction track at: https://start.crowdsec.net
Sharing insights and taking swift action can collectively reduce the impact of these threats. This is your call to action for real-time threat intelligence and collaborative cybersecurity.
Want to stay ahead of the latest cyber threats? Get our weekly Threat Alert Newsletter delivered straight to your inbox, along with critical threat updates and trending cybersecurity insights. 📩 Sign up now for exclusive access
If you’re already subscribed, feel free to like and share this post to help your network stay informed about current threats.