Vulnerability threat dossier
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
VTP analyst assessment
CVE-2026-63030 is a WordPress REST API batch-route confusion flaw. Combined with CVE-2026-60137 SQL injection, it can enable SQL injection and remote code execution. CISA and ENISA list known exploitation.
4 record references and 3 source references passed trusted post-response validation. The current deterministic record contains 1 independent evidence group.
The reporting does not establish that CVE-2026-63030 was the specific WordPress flaw used in every reported incident.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
If you use WordPress 6.9.x, update to 6.9.5 or later; if you use 7.0.x, update to 7.0.2 or later.
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
EPSS is 0.10; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
3 primary sources · 0 dependent secondary reports · 3 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
Predictive context changed; this is not exploitation evidence.
Rapid7 Research published evidence linked to CVE-2026-63030.
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2026-63030.
Rapid7 Research published evidence linked to CVE-2026-63030.
ProjectDiscovery Nuclei Templates Releases published evidence linked to CVE-2026-63030.
Cisco Talos published evidence linked to CVE-2026-63030.
ENISA EU KEV reports known exploitation. This is public intelligence, not a VTP sensor observation.
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. [...]
New Templates Added: 112 | CVEs Added: 101 | First-time contributions: 22 🔥 Release Highlights 🔥 [CVE-2026-72898] Metabase - Unauthenticated SQL Injection (@0x_Akoko, @pdteam ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-71362 ] Adobe Commerce/Magento - Customer Session Identity Switch (@0x_Akoko, @dinosn ) [critical] 🔥 [ CVE-2026-64849 ] MLflow Webhook SSRF - Unauth Full-Read via Redirect Bypass ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [CVE-2026-64638] WordPress Core < 7.0.3 - Preauth Reflected XSS (XSS2Shell) ( @flx | Nick Vidovic (greenhats)) [high] 🔥 [ CVE-2026-63077 ] JetBrains TeamCity < 2026.1.3, 2025.11.7 - RCE (@0x_Akoko, @pdteam ) [critical] (kev) (vKEV) 🔥 [CVE-2026-59774] Gitea 1.22.1-1.27.0 - Unauthenticated Arbitrary File Read ( @ashish-cybersec ) [critical] 🔥 [ CVE-2026-58644 ] Microsoft SharePoint Server - WS-Federation Deserialization RCE ( @pdteam ) [critical] (kev) (vKEV) 🔥 [CVE-2026-57219] RabbitMQ Management - OAuth 2 Client Secret Disclosure ( @Aryu-RU ) [high] 🔥 [ CVE-2026-56270 ] Flowise <= 3.0.13 - Unauth OAuth Configuration Disclosure (@0x_Akoko, @pdteam ) [high] (vKEV) 🔥 [CVE-2026-53576] Kestra <= 1.3.20 - Remote Code Execution (@0x_Akoko, @pdteam , @Aryu-RU ) [critical] (vKEV) 🔥 [ CVE-2026-52806 ] Gogs <= 0.14.2 - Auth RCE via git rebase Argument Injection ( @dhiyaneshdk , @pdteam ) [critical] (vKEV) 🔥 [ CVE-2026-49049 ] JoomShaper Helix3 <=3.1.0 - Unauth Arbitrary JSON File Write ( @dhiyaneshdk , @pdteam ) [high] (vKEV) 🔥 [ CVE-2026-48939 ] Joomla iCagenda < 3.9.10 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-40217 ] LiteLLM < 1.25.0 - Remote Code Execution ( @ritikchaddha ) [high] (vKEV) 🔥 [ CVE-2026-34908 ] UniFi OS - Authentication Bypass via Path Traversal (..%2f) ( @Boreas37 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-20896 ] Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Auth Bypass ( @prithvee07 ) [critical] (vKEV) 🔥 [ CVE-2026-19478 ] GitLab CE/EE - GraphQL @gl_introduced Arbitrary Method Invocation (@0x_Akoko, @dhiyaneshdk ) [critical] (vKEV) 🔥 What's Changed Bug Fixes Corrected an unclosed string literal in the CVE-2026-0558 dsl matcher (PR #16950 ). Fixed a broken matcher in the newly added CVE-2026-3395 template (PR #16886 ). Fixed the username key structure in mysql-empty-password.yaml (PR #16939 ). Fixed indentation in kubernetes-metrics.yaml (PR #16934 ). Added the missing capture group to regex extractors in oracle-containers-panel, smtp-credentials-exposure and springboot-x-application-context (PR #16663 ). Corrected the max-request counter for CVE-2021-40822 (PR #16875 ). Corrected email and password variable names in CVE-2025-68613 (PR #16918 ). Renamed Wix-detect.yaml, cve-2026-44338 .yaml and CVE-2026-44381.yaml to match the naming convention (PRs #16731 , #16729 , #16730 ). Moved 22 invalid or rejected CVE templates to vulnerabilities (PR #16889 , Issue #16115 ). Removed CVE-2024-28752 .yaml (PR #16745 ). False Negatives CVE-2017-5521 , CVE-2017-7615 and CVE-2020-23575 — regexes were placed in word matchers, so these templates could never fire (PR #16666 ). nh-c2 — corrected a dsl matcher that could never match (PR #16739 ). CVE-2026-21858 — added a /rest/sentry.js fallback to detect n8n 1.65.0 through 1.111.x (PR #16888 ). CVE-2025-14847 — now detects vulnerable MongoDB 8.0.x via buildinfo read-size truncation (PR #16741 ). CVE-2025-32969 — removed an incorrect content_type matcher that suppressed matches (PR #16704 ). CVE-2023-37629 — closed the filename quote before the .php extension so the payload is well formed (PR #16709 ). False Positives CVE-2025-29927 — added negative matchers so WAF block pages returning HTTP 200 no longer match (PR #16870 , Issue #16782 ). wp-vr-view-xss and vrview-xss — no longer fire on hosts that escape the payload (PR #16912 ). wordpress-eol — tightened an over-broad version regex (PR #16752 ). CVE-2021-24139 — both conditions must now match rather than either (PR #16748 ). Marked prec
This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads (more details on the [official 6.5 release blog post](https://www.rapid7.com/blog/post/pt-metasploit-framework-6-5-released/)!). Windows on ARM confirm to be the new first-class citizenship thanks to brand-new AArch64 reverse-TCP shells (both inline and staged), so your Snapdragon boxes can join the party too. Last but not least, an important message: *Nyan Nyan Nyan Nyan Nyan Nyan.* New module content (13) Ray Dashboard Logs API Path Traversal Author: Richard Howe <rhowe425> Type: Auxiliary Pull request: #21681 contributed by rmhowe425 Path: `gather/ray_dashboard_logs_api_path_traversal` Description: This adds an auxiliary module that leverages a path traversal vulnerability in Ray to list the contents of local directories. There is currently no CVE assigned to this vulnerability. Issuance is pending with MITRE. Pterodactyl Panel CVE-2025-49132 Remote Code Execution Authors: 0xtensho and jheysel-r7 Type: Exploit Pull request: #21452 contributed by jheysel-r7 Path: `linux/http/pterodactyl_locales_locale_json` AttackerKB reference: CVE-2025-49132 Description: This adds a module which exploits a vulnerability in Pterodactyl Panel before version 1.11.11 that allows unauthenticated remote code execution through improper handling of locale file operations. The vulnerability, CVE-2025-49132, exists in the locale.json endpoint which allows path traversal and arbitrary file creation. This combination of capabilities results in remote code execution in the context of the user running the web server. SonicWall SMA1000 WorkPlace wsproxy SSRF Remote Command Execution Authors: Deral Heiland, Rapid7 Vulnerability Research, and Ryan Emmons Type: Exploit Pull request: # 21678 contributed by dheiland-r7(https://github.com/dheiland-r7) Path: `linux/http/sonicwall_sma1000_wsproxy_rce` AttackerKB reference: CVE-2026-15409 Description: This adds a new exploit module for CVE-2026-15409, a Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 WorkPlace wsproxy service. Fragnesia LPE (CVE-2026-46300) Authors: William Bowling and msutovsky-r7 Type: Exploit Pull request: #21456 contributed by msutovsky-r7 Path: linux/local/cve_2026_46300_fragnesia AttackerKB reference: CVE-2026-46300 Description: This adds a local module for the Fragnesia exploit which is a page-cache replacement vulnerability in the Linux kernel's XFRM (IPsec) subsystem, tracked as CVE-2026-46300. Ghost CMS Remote Code Execution Authors: Cristian-Alexandru Staicu and Maksim Rogov Type: Exploit Pull request: #21234 contributed by vognik Path: multi/http/ghostcms_auth_rce_cve_2026_29053 AttackerKB reference: CVE-2026-22594 Description: This adds an exploit module for Ghost CMS (CVE-2026-29053) that achieves remote code execution by uploading a malicious theme. Ghost's theme renderer evaluates untrusted JSONPath expressions through the {{#get}} helper, letting the module inject and trigger arbitrary code once a theme is uploaded and activated. You'll need valid admin or staff credentials to authenticate. Joomla Content Editor Unauthenticated File Upload RCE Authors: David Jardin, Uwe Flottemesch, and ispyispyispy Type: Exploit Pull request: #21615 contributed by 15py15py15py Path: multi/http/joomla_com_jce_unauth_file_upload_rce AttackerKB reference: CVE-2026-48907 Description: This adds a new exploit module for CVE-2026-48907, an unauthenticated arbitrary profile creation vulnerability in the JCE (Joomla Content Editor) extension for Joomla!. The profiles.import task fails t
New Templates Added: 122 | CVEs Added: 49 | First-time contributions: 23 🔥 Release Highlights 🔥 [CVE-2026-63030] WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion ( @slcyber , @mielverkerken , @pdteam , @FLX-0x00 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-60004 ] Gitea <= 1.27.0 - Pre-Auth Remote Code Execution (@0x_Akoko) [critical] 🔥 [ CVE-2026-58455 ] Dockwatch <= 0.6.567 - OS Command Injection ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-56291 ] Balbooa Forms < 2.4.1 - Unauth Arbitrary File Upload ( @nick Vidovic, @0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-56290 ] Page Builder CK <= 3.5.10 - Unauth File Upload ( @panchiko-p , @0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-48908 ] Joomla SP Page Builder <= 6.6.1 - Unauth Arbitrary File Upload RCE (@0x_Akoko) [critical] (kev) (vKEV) 🔥 [ CVE-2026-46442 ] Flowise < 3.1.2 - node-custom-function Unauth RCE ( @dhiyaneshdk , @princechaddha ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-44825 ] Apache Solr 9.4.0-9.10.1 / 10.0.0 - Hardcoded Default Credentials ( @pdteam , @0x_Akoko) [high] (kev) (vKEV) 🔥 [ CVE-2026-16232 ] Check Point Security Management Server - SmartConsole Authentication Bypass ( @sfewer-r7 , @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-15409 ] SonicWall SMA1000 - Server-Side Request Forgery ( @dhiyaneshdk , @rapid7 ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-9282 ] W3 Total Cache <= 2.9.4 - Unauth Arbitrary File Read (@0x_Akoko) [high] (kev) (vKEV) 🔥 [ CVE-2026-8732 ] WP Maps Pro (wp-google-map-gold) <= 6.1.0 - Unauth Administrator Account Creation ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-8713 ] Avada (Fusion) Builder <= 3.15.3 - Unauth Arbitrary File Deletion (@rool-machine) [critical] (kev) (vKEV) 🔥 [ CVE-2026-6875 ] ServiceNow AI Platform - Pre-Auth JavaScript Sandbox Escape RCE ( @pdteam , @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2026-3296 ] Everest Forms WordPress Plugin <= 3.4.3 - PHP Object Injection ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-71334 ] Flowise - Path Traversal ( @theamanrawat ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-68493 ] Apache Struts XWork - XML External Entity Injection ( @pussycat0x ) [high] (kev) (vKEV) 🔥 [ CVE-2025-54988 ] Apache Tika - XXE Injection ( @tx1ee ) [critical] 🔥 [ CVE-2025-6389 ] Sneeit WP Social WordPress Plugin - Unauth RCE via call_user_func ( @dhiyaneshdk ) [critical] (kev) (vKEV) 🔥 [ CVE-2025-2505 ] WordPress Age Gate <= 3.5.3 - Unauth Local File Inclusion ( @pussycat0x ) [critical] (kev) (vKEV) 🔥 [CVE-2024-56511] DataEase < 2.10.4 - Authentication Bypass via Whitelist Path Traversal ( @ChrisJr404 ) [critical] 🔥 [ CVE-2023-34992 ] Fortinet FortiSIEM - Unauth Command Injection ( @Thacien ) [critical] 🔥 What's Changed Bug Fixes Stopped credential-stuffing and token-spray templates from sending their first request when no username, password or token is supplied (PR #16589 , Issue #11238 ). Restored missing matcher and extractor values in four templates that silently no-op'd, including CVE-2021-44228 , CVE-2021-45046 and CVE-2026-42281 (PR #16661 ). Replaced an unsupported RE2 lookahead that stopped home-env-permission.yaml from loading at all (PR #16664 ). Added the missing capture group to three regex extractors (PR #16665 ). Corrected the extractor part in portal-api-ssrf from interactsh to interactsh_request (PR #16667 ). Corrected the DSL variable in thinkphp6-arbitrary-write from status_2 to status_code_2 (PR #16668 ). Unhid two extractors marked internal that nothing consumed (PR #16669 ). Marked the setup-stage matchers in CVE-2025-2075 as internal (PR #16671 ). Removed an AWS access key ID from a reference URL in CVE-2024-51482.yaml (PR #16616 ). Fixed an intrusive tag typo in CVE-2023-34124 .yaml (PR #16675 ). Corrected the id and filename for the IBM DB2 Server template (PR #16688 ). Fixed the severity in directory-listing-no-host-header.yaml (PR #16614 ). Corrected the author field for CVE-2024-23108 (PR #16620 ). Moved CVE-2025-296
Thorsten explores Q2 2026 stats, the artificial buffer zone of 2026, and why smart, prioritized patching is more critical than ever.
ENISA EU KEV lists this vulnerability as known to be exploited. This is public intelligence, not a VTP sensor observation.
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.