Critical WordPress Core RCE Vulnerabilities CVE-2026-63030

🔍 RESEARCH & DEEP DIVES

• Critical WordPress Core RCE Vulnerability CVE-2026-63030 and CVE-2026-60137 Disclosed — research.eye.security
  Two unauthenticated WordPress core vulnerabilities allow remote code execution on default installs.

  • Applies to WordPress core versions 6.8.0–7.0.1 with varying exposure levels
  • CVE-2026-63030 is a REST API route confusion bug; CVE-2026-60137 is an SQL injection in WP_Query
  • Exploit chain enables unauthenticated attackers to escalate to rogue admin and deploy webshells
  • Attack uses batch POST requests exploiting REST endpoint and UNION-based SQL injection
  • WordPress forced auto-updates to patch millions of sites, but some remain unpatched or compromised

• Meshtastic GitHub repo vulnerable to arbitrary code execution via pull_request_target — cve.threatint.com
  Meshtastic GitHub repo allowed arbitrary code execution through pull_request_target in CI workflow.

  • Applies to Meshtastic mesh networking solution versions prior to 2.7.21.1370b23
  • Vulnerability in main_matrix.yml GitHub Actions workflow triggered by pull_request_target
  • CI workflow checks out attacker fork code and executes it with repository secrets and elevated GITHUB_TOKEN
  • No approval gate for pull requests from external users with author_association 'NONE'
  • Potential impact includes supply chain compromise, self-hosted runner compromise, and repository takeover

🔓 CVEs & KEV

• CVE-2026-42566 — CVSS 7.5 — Meshtastic: Malformed UTF-8 in User.long_name broadcast over LoRa causes mesh instability.
• CVE-2026-45138 — CVSS 5.4 — CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule.