The site was tested for the July-2026 WordPress REST batch route-confusion RCE chain and its associated SQL injection. From an unauthenticated external position the site is not exploitable for these issues, confirmed two independent ways: the vulnerable entry point is blocked at the edge, and the non-destructive injection test does not confirm.

Vulnerability validation

The route-confusion chain cannot begin (entry point refused before any query runs), and no injectable channel is reachable. Defence in depth: the edge block alone neutralises the external vector even independent of core patch level.

WordPress enumeration

WAF / edge controls observed

Evidence (tool output)

# wp2shell_check.py check https://www.pwndefend.com --sleep 3
[i] method: batch  CVE-2026-63030 (batch/v1 route-confusion)
[i] baseline SLEEP(0)   median : 0.04s
[i] inject   SLEEP(3)   median : 0.04s
[i] delta -0.00s  (threshold 1.95s)
[-] NOT confirmed  patched (>=6.9.5/7.0.2), edge-blocked, or no batch route.

# /batch/v1 entry point (all forms)
GET  /?rest_route=/batch/v1   403      POST /?rest_route=/batch/v1  403
GET  /wp-json/batch/v1        403      POST /wp-json/batch/v1       403

⚠ For the internal record: core version is hardened away and could not be confirmed externally. Confirm from the dashboard that core is ≥ 7.0.2 / 6.9.5 to close the “patched version” evidence.

1. Executive summary

The site was tested for the July-2026 WordPress REST batch route-confusion RCE chain (CVE-2026-63030) and its associated author__not_in SQL injection (CVE-2026-60137). From an unauthenticated external position the site is not exploitable for these issues, confirmed two independent ways:

• The vulnerable entry point is blocked at the edge. Every request to the /batch/v1 REST route returns 403 (all methods, both URL forms) — the route-confusion chain cannot begin.
• The non-destructive injection test does not confirm. The safe time-based differential shows a ~0 s delta — no injectable channel is reachable.

The site is also well-hardened for enumeration: the core version is not disclosed, user enumeration is blocked, sensitive files are not served, and a WAF (Cloudflare edge + Wordfence origin) is active. One item for the internal record: the core version could not be confirmed externally (by design) — see Limitations.

2. Scope & rules of engagement

• Authorised by the site owner; asset is self-owned. Performed for internal assurance (“we test our own estate”).
• Non-destructive only. No exploitation was attempted. The tool’s rce/dump/dfir capabilities were not used against production. Only recon (GET-only enumeration) and check (a benign time-based differential) were run, plus read-only requests.
• Unauthenticated, external perspective (no credentials, public internet).

3. WordPress enumeration

4. Vulnerability validation — CVE-2026-63030 / 60137

4.1  Entry point (/batch/v1) is edge-blocked

The batch route is registered (advertised in the REST index) — i.e. the underlying WordPress line includes the batch feature — but every request is rejected with 403 before reaching application logic:

A path-targeted block on batch/v1 — exactly the recommended edge stopgap for CVE-2026-63030. The block is served through Cloudflare; Wordfence is installed at origin and is the likely enforcer.

4.2  Non-destructive injection test does not confirm

# wp2shell_check.py check https://www.pwndefend.com --sleep 3
[i] method: batch  CVE-2026-63030 (batch/v1 route-confusion)
[i] baseline SLEEP(0)   median : 0.04s
[i] inject   SLEEP(3)   median : 0.04s
[i] delta -0.00s  (threshold 1.95s)
[-] NOT confirmed  patched (>=6.9.5/7.0.2), edge-blocked, or no batch route.

A vulnerable host shows the injected SLEEP(3) controlling server-side query time (delta ≈ 3 s). Here the delta is ~0 s — no injectable channel is reachable.

4.3  Conclusion

Not vulnerable from an unauthenticated external position. The chain is defeated at two independent layers — the edge block (entry point) and the absence of any confirmable injection (application). Even were core unpatched, the edge block alone neutralises the external vector (defence in depth).

5. WAF / edge controls observed

Note: signature-style UA blocking is easily evaded (a real attacker spoofs the UA — as demonstrated, the honest tool UA passed). It is a useful noise filter, not a control to rely on. The batch/v1 path block and core patching are the substantive controls.

6. Limitations

• Core version not externally confirmable. Version disclosure is hardened away (a positive finding). The “not vulnerable” conclusion therefore rests on behavioural evidence (4.2) and the edge block (4.1), not a version number.
• CVE-2026-60137 via a facilitating plugin (a plugin/theme passing a raw request string to WP_Query author__not_in) cannot be enumerated blind externally. The core batch-delivered path is blocked; a plugin code review would be needed to fully exclude a facilitated sink.
• Testing was unauthenticated and non-destructive by design; no authenticated or exploitation testing was performed.

7. Recommendations

1. Confirm & record core version ≥ 7.0.2 / 6.9.5 from the dashboard (closes the Limitations item above).
2. Keep the batch/v1 edge block even after patching — cheap defence in depth.
3. Maintain current hardening: version suppression, user-enumeration block, sensitive-file blocks, Wordfence + Cloudflare. All verified effective.
4. Optional: disable xmlrpc.php if unused (currently reachable, POST-only).
5. Do not rely on UA-based blocking as a control — it filters noise only.

Appendix A — evidence log (selected)

Reproduce with wp2shell_check.py recon https://www.pwndefend.com --json pwndefend_recon.json then wp2shell_check.py check https://www.pwndefend.com --sleep 3 -A chrome.

# Fingerprint
GET  /                         200   Server: cloudflare, CF-RAY, HSTS preload; no generator meta
GET  /readme.html              404
GET  /?feed=rss2               (no <generator>)

# REST / surface
GET  /?rest_route=/            200   name="PwnDefend"; namespaces incl. wordfence/v1, ai1wm/v1, wp/v2
GET  /wp-json/                 200   (pretty permalinks also active)

# Enumeration hardening
GET  /?rest_route=/wp/v2/users 401   rest_user_cannot_view
GET  /?author=1                404
GET  /wp-login.php             200
GET  /xmlrpc.php               405   POST-only
GET  /wp-content/debug.log     403
GET  /wp-config.php.bak        403
GET  /wp-content/uploads/      403

# CVE entry point — blocked
POST /?rest_route=/batch/v1    403       GET /?rest_route=/batch/v1    403
POST /wp-json/batch/v1         403       GET /wp-json/batch/v1         403

# Non-destructive injection test
check -> delta -0.00s -> NOT confirmed

# WAF UA sensitivity (home page)
UA "sqlmap/1.8"                403
UA browser | empty | tool      200