1name: crowdsecurity/vpatch-CVE-2026-63030
2description: 'Detects WordPress REST API batch route confusion (CVE-2026-63030) and related blind SQL injection attempts via author_exclude (CVE-2026-60137).'
3rules:
4  # Node 1 - Parsing confusion
5  - or:
6    - and:
7        - zones: [URI_FULL]
8          transform: [lowercase, urldecode]
9          match: {type: contains, value: 'batch/v1'}
10        - zones: [RAW_BODY]
11          transform: [lowercase]
12          match: {type: regex, value: '\x22path\x22\s*:\s*\x22[^/\x22]'}
13    # Node 2 - author_exclude/author__not_in SQLi
14    - and:
15        - zones: [URI_FULL]
16          transform: [lowercase, urldecode]
17          match: {type: contains, value: 'batch/v1'}
18        - zones: [RAW_BODY]
19          transform: [lowercase, urldecode]
20          match: {type: regex, value: 'author_(?:exclude|_not_in)\s*=\s*[^0-9]+'}
21labels:
22  type: exploit
23  service: http
24  confidence: 3
25  spoofable: 0
26  behavior: 'http:exploit'
27  label: 'WordPress - SQLi'
28  classification:
29    - cve.CVE-2026-63030
30    - cve.CVE-2026-60137
31    - attack.T1190
32    - cwe.CWE-89