🔴 CVE-2026-63030: High Exploit Probability — 98% Chance of Exploitation — WordPress Core

Overview

CVE-2026-63030 is a newly disclosed vulnerability, published on July 17, 2026. Details are still emerging; review the references below for updates.

Threat Intelligence

Exploit Prediction (EPSS)

The FIRST EPSS model rates this vulnerability at 98.1% exploit probability (Very High). This places it in the top 99% of all known CVEs by likelihood of exploitation in the next 30 days.

EPSS (Exploit Prediction Scoring System) uses real-world exploit data and machine learning to predict whether a vulnerability will be exploited. A high EPSS score is a strong signal to prioritize remediation.

Affected WordPress Software

Recommended Actions

1. Update immediately — Upgrade WordPress Core to version 6.9.5 / 7.0.2.
2. Update WordPress Core — In your WordPress admin dashboard, navigate to Dashboard → Updates and click "Update Now". Alternatively, download the latest version from wordpress.org and manually replace core files.
3. Audit your site — Review access logs for suspicious activity, especially POST requests to /wp-json/batch/v1 or /?rest_route=/batch/v1.
4. Run a security scan — Use ThreatSpot to check your WordPress site for this and other vulnerabilities.

References

• NVD Entry for CVE-2026-63030
• EPSS Score for CVE-2026-63030

CVE data aggregated from the National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities catalog, and FIRST EPSS. Analysis updated as new intelligence becomes available. Last updated: 2026-07-22.