WordPress Flaw Chain Lets Attackers Take Over Sites Without a Login, and Raises Questions About Code Review

WordPress powers around half of all websites, roughly 500 million, so a newly reported pre-authentication remote code execution (RCE) flaw is a major concern. Searchlight Cyber found the issue, and Hacktron reports that any WordPress site running an affected version is open to unauthenticated remote code execution, with no preconditions. Attackers do not need an account or any special setup.

The problem is a chain of two vulnerabilities. CVE-2026-63030 is a route handler confusion issue in the REST API batch endpoint, which bundles several requests into one. Because of the flaw, a request can be checked against one route's rules but processed by a different route's handler. CVE-2026-60137 is an SQL injection in WordPress core, caused by incomplete cleaning of one search parameter when it arrives as a string rather than a list. On its own, the second flaw would not directly affect a default site, unless a plugin or theme supplied a way to reach it. The first flaw gives WordPress core that missing path.

Hacktron uses the case to ask a broader question: after years of trying to stop vulnerabilities at the source, how far have we come? Its planned experiment is to test whether today's code review and SAST tools could have blocked the historical changes that introduced these flaws. The excerpt we reviewed does not include the results.