KEV Entry

CVE-2026-63030

Known Exploited Vulnerability Entry ENISA

Back to Catalog View Vulnerability
Entry Details
Confirmed Exploited

CVE-2026-63030

2026-09-21 00:00 UTC

Timestamps

2026-09-21

2026-09-21

Scope

Affected: WordPress Foundation / WordPress | Description: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution. EU victimology. | Patched since: 2026/07/17 | Exploitation type: unknown | CWEs: CWE-436 | Origin source: ENISA | Notes: https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

References
  • {'id': 'CVE-2026-63030', 'url': 'https://www.cve.org/CVERecord?id=CVE-2026-63030'}
  • {'id': 'EUVD-2026-45280', 'url': 'https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-45280'}
  • {'id': 'source', 'url': 'https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally'}
  • {'id': 'source', 'url': 'https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137'}

de08f2aa-0035-43e6-a24f-537bcdc90922

ENISA
cce329bf-df49-4c6e-a027-80be2e6483bd

2026-09-23 20:00 UTC

2026-09-23 20:00 UTC

Evidence
1
Type Source Signal Confidence Details GCVE Metadata
csirt_report enisa-cnw-kev successful_exploitation 0.75
View details 
{
  "catalog": "ENISA / EU CSIRTs Network (CNW) KEV JSON",
  "cwes": [
    "CWE-436"
  ],
  "dateReported": "2026/09/21",
  "euvd": "EUVD-2026-45280",
  "exploitationType": [
    "unknown"
  ],
  "notes": "https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137",
  "originSource": "ENISA",
  "patchedSince": "2026/07/17",
  "product": "WordPress",
  "threatActorsExploiting": [],
  "vendorProject": "WordPress Foundation",
  "vulnerabilityName": ""
}
 -
Export Options
JSON Object JSON API View Full Catalog