WordPress Pre-Auth RCE CVE-2026-63030: Vulnerability Details and PoC Exploit Code Now Public

WordPress released 7.0.2 (and backports 6.9.5, 6.8.6) to fix a critical pre-auth RCE (CVE-2026-63030) that chains from a blind SQL injection (CVE-2026-60137). A public proof-of-concept exists, the issue affects many stock installs via the unauthenticated REST /batch/v1 endpoint, and administrators are urged to patch immediately or apply WAF rules to block the endpoint as a temporary mitigation.