CVE-2026-63030 is a SQL injection vulnerability in WordPress Core's REST API that permits unauthenticated remote code execution. The vulnerability is exploited by sending crafted POST requests to the REST API endpoint, leveraging UNION SELECT statements to inject PHP code that writes a webshell file to the server's cache directory. The webshell executes arbitrary system commands while returning a 404 error page to evade detection. Attackers have also used this exploit to create unauthorized admin users in the WordPress database. The vulnerability requires the REST API to be exposed and accessible. Exploit attempts have been observed shortly after the vulnerability was publicly disclosed.

Successful exploitation of CVE-2026-63030 allows unauthenticated attackers to execute arbitrary code on the affected WordPress server. This can lead to full system compromise, including the ability to upload webshells, execute system commands, and create unauthorized administrative users. The presence of a stealthy webshell that returns false 404 errors complicates detection and remediation. The vulnerability affects WordPress Core, not plugins, increasing the potential attack surface. Exploitation is active in the wild shortly after disclosure.

Patch status is not yet confirmed — check the official WordPress vendor advisory for current remediation guidance. Until a patch is available, users should assume compromise if vulnerable. Immediate mitigation includes verifying exposure of the REST API and restricting access if possible. Users should inspect the /wp-content/cache/ directory for suspicious PHP files such as '94uh9ubh6e1x.php' and remove any unauthorized files. Additionally, review the WordPress user database for recently created or unauthorized admin accounts and remove them. Monitor for unusual activity related to the REST API. Follow official WordPress security advisories for updates and patches.