Overview
CVE-2026-63030 is a newly disclosed vulnerability, published on July 17, 2026. Details are still emerging; review the references below for updates.
Threat Intelligence
| Metric | Value |
|---|---|
| CVE ID | CVE-2026-63030 |
| Severity | UNKNOWN |
| CVSS Score | 0.0/10 |
| CISA KEV | ❌ Not in KEV catalog |
| EPSS Score | 10.6% exploit probability |
| EPSS Percentile | Top 99% of all CVEs |
Affected WordPress Software
| Software | Type | Affected Versions | Fixed In |
|---|---|---|---|
| WordPress Core | WordPress Core | >=6.9.0,<6.9.5;>=7.0.0,<7.0.2 | 6.9.5 / 7.0.2 |
Recommended Actions
- Update immediately — Upgrade WordPress Core to version 6.9.5 / 7.0.2.
- Update WordPress Core — In your WordPress admin dashboard, navigate to Dashboard → Updates and click "Update Now". Alternatively, download the latest version from wordpress.org and manually replace core files.
- Audit your site — Review access logs for suspicious activity, especially POST requests to
/wp-json/batch/v1or/?rest_route=/batch/v1. - Run a security scan — Use ThreatSpot to check your WordPress site for this and other vulnerabilities.
References
CVE data aggregated from the National Vulnerability Database (NVD), CISA Known Exploited Vulnerabilities catalog, and FIRST EPSS. Analysis updated as new intelligence becomes available. Last updated: 2026-07-22.