WordPress Core Interpretation Conflict Vulnerability (CVE-2026-63030)

let SuspiciousPaths = dynamic(["/wp-admin/", "/wp-login.php", "/wp-json/", "/xmlrpc.php"]);
AppServiceHTTPLogs
| where TimeGenerated > ago(24h)
| where CsUriStem has_any (SuspiciousPaths)
| where (CsUriQuery has "%00" or CsUriQuery has "%0d%0a" or CsUriQuery has ".." or CsUriStem matches regex @"%[0-9a-fA-F]{2}%[0-9a-fA-F]{2}")
| extend AnomalousHeader = iff(CsBytes == 0 and Method == "POST", true, false)
| where AnomalousHeader == true or ScStatus in (200, 201, 302)
| summarize RequestCount = count(), Paths = make_set(CsUriStem), Queries = make_set(CsUriQuery) by CIp, bin(TimeGenerated, 5m)
| where RequestCount > 5
| project TimeGenerated, CIp, RequestCount, Paths, Queries

index=web sourcetype=access_combined (uri_path="*/wp-admin/*" OR uri_path="*/wp-login.php*" OR uri_path="*/wp-json/*" OR uri_path="*/xmlrpc.php*")
| eval encoded_anomaly=if(match(uri_query, "%00|%0d%0a|\.\.") OR match(_raw, "(?i)transfer-encoding.*content-length|content-length.*transfer-encoding"), 1, 0)
| where encoded_anomaly=1
| bin _time span=5m
| stats count as request_count, values(uri_path) as paths, values(uri_query) as queries by clientip, _time
| where request_count > 5
| sort -request_count

sequence by source.ip with maxspan=5m
  [network where event.dataset == "nginx.access" and url.path : ("*/wp-admin/*", "*/wp-login.php*", "*/wp-json/*", "*/xmlrpc.php*") and (url.query : "*%00*" or url.query : "*%0d%0a*" or url.query : "*..*")]
  [network where event.dataset == "nginx.access" and http.response.status_code >= 200 and http.response.status_code < 400]

SELECT sourceip, destinationip, URL, "Payload" as payload, COUNT(*) as requestCount
FROM events
WHERE devicetype = 'WebServer'
AND (URL ILIKE '%wp-admin%' OR URL ILIKE '%wp-login.php%' OR URL ILIKE '%wp-json%' OR URL ILIKE '%xmlrpc.php%')
AND (URL ILIKE '%\%00%' ESCAPE '\' OR URL ILIKE '%\%0d\%0a%' ESCAPE '\' OR URL ILIKE '%..%')
GROUP BY sourceip, destinationip, URL
HAVING COUNT(*) > 5
LAST 24 HOURS

_sourceCategory=*web/access*
| where uri_path matches "*/wp-admin/*" or uri_path matches "*/wp-login.php*" or uri_path matches "*/wp-json/*" or uri_path matches "*/xmlrpc.php*"
| where uri_query matches "*%00*" or uri_query matches "*%0d%0a*" or uri_query matches "*..*"
| timeslice 5m
| count by client_ip, _timeslice, uri_path
| where _count > 5
| sort by _count

rule wordpress_interpretation_conflict_cve_2026_63030 {
  meta:
    author = "df00tech"
    description = "Detects anomalous encoded requests to WordPress core endpoints consistent with CVE-2026-63030 interpretation-conflict exploitation"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /.*(wp-admin|wp-login\.php|wp-json|xmlrpc\.php).*/
    $e.network.http.method = "POST" or $e.network.http.method = "GET"
    re.regex($e.target.url, `%00|%0d%0a|\.\.`)
  match:
    $e.principal.ip over 5m
  condition:
    $e
}

#event_simpleName=HttpRequest
| in(field="HttpUrl", values=["*wp-admin*", "*wp-login.php*", "*wp-json*", "*xmlrpc.php*"])
| regex(field="HttpUrl", pattern="%00|%0d%0a|\.\.")
| groupBy([ClientIp, HttpUrl], function=count(as="requestCount"))
| requestCount > 5