WordPress RCE Chain Exposes the Plugin Supply Chain

Nick d

On July 17, 2026, WordPress core developers pushed out an emergency background auto update for WordPress 7.0.2 to fix two critical flaws, CVE 2026 63030 and CVE 2026 60137. It was an unauthenticated Remote Code Execution exploit chain, and it affected millions of sites in a matter of hours.

Ben cohen

Wait, millions of sites forced to auto update all at once? That, that means the REST API desynchronization flaw was actively harvestable without even needing a login?

Nick d

It, it really was. What happened was, if an attacker sent batch requests to slash wp json slash batch slash v1, parallel validation arrays inside class wp rest server dot php completely lost index alignment whenever a sub request hit an error. And once those arrays got out of sync, the server skipped route validation entirely. It let unauthenticated calls bypass REST security checks.

Ido

So you bypass the route check, but how do you get all the way to Remote Code Execution from a broken array alignment?

Nick d

That is where the second flaw came in, a REST API batch route confusion and SQL injection issue leading to Remote Code Execution. In wp includes slash class wp query dot php, passing an array to author not in sanitized the inputs properly. But if you passed a raw string parameter instead, it completely bypassed sanitization. Raw SQL got injected right into the query.

Ben cohen

So an unauthenticated attacker hits the batch route, breaks array alignment, and feeds a raw string into WP Query to execute arbitrary SQL on the server. That is, um, that is terrifyingly elegant.

Nick d

And the trickiest part for developers was testing for it. If you sent a test request to slash wp json slash batch slash v1, both patched and vulnerable sites returned an identical HTTP 200 status code response. People were looking at surface level HTTP status checks and assuming their firewall or site was safe when it was still completely exposed underneath.

Ido

Right, because a 200 OK just means the batch endpoint exists and responded, not that class wp rest server dot php is actually validating sub request indexes correctly.

Nick d

And this ties into a much bigger problem across the entire ecosystem. The WP Goldmine report analyzed over fifty seven thousand plugins recently and found that twenty four percent of plugins in the ten thousand to one hundred thousand active install band have not been updated in over two years. That is twelve hundred and nine popular plugins, including things like Limit Login Attempts and WP Downgrade, just sitting there abandoned with real user bases.

Ben cohen

Twelve hundred and nine plugins with up to one hundred thousand installs, zero maintainers, running on live production sites. I mean, at what point does core step in? Should WordPress core enforce mandatory deprecation flags or facilitate developer takeovers for stale code?

Ido

I, I see the argument for core enforcement, but forcing automatic updates or deprecating plugins at the core level carries huge risks for enterprise stacks. If core aggressively purges or alters plugins, you risk breaking custom workflows on sites that rely on legacy hooks.

Nick d

Which is why agencies cannot rely on surface checks or wait for core to fix supply chain risk. In our own developer workflows, we enforce strict array type casting using wp parse id list to ensure string parameters can never reach database queries as unassigned types. We also automate post update checksum verification to make sure core files match official repositories after emergency patches like 7.0.2.

Ben cohen

So instead of guessing whether an endpoint is safe, you verify file integrity at the file system level and run automated plugin auditing tools to purge abandoned utilities before an exploit chain finds them.

Ido

Clean code discipline at the application layer beat reactive fire drills every single time.