while in reality it is wordpress core is haunting itself, long time already …
the truth hurts, but what it is about is practically nobody does anything useful until not hitten by a stroke
so things keep existing in the dark and the exploits announced by the latest wp vulnerabilities CVE-2026-63030 and CVE-2026-60137are just wakeup-calls
it starts that rest-api in reality is a wp-json thing and what nobody never did is looking at it and requesting his site website/wp-json or wp-json/wp/v2/posts, website/wp-json/wp/v2/pages or even more specific adding a page ID or post ID to the latter two … in order to see what happens
you should do it right now and read careful what you see in your browser window – a detailed info about everything, including stuff what nobody should know but the site admin …
soooo, your mouth’s still open? that’s good, now you might listen better, no noise disturbing your eyes and ears, here comes what you need to do
your control is the .htaccess, you depend on nobody and are free to add what you need, in this case, shutting the door not only for curious kiddy hacker but also for the professional a*holes
since wordpress, specially gutenberg blocks, depend on rest-api you can not block rest-api totally, so you need to allow your access, the condition, then define the trigger (rule)
the schema is
RewriteCond %{REMOTE_ADDR} !^123.123.123.
and others
RewriteRule wp-json(/.*)?$ … your action
of course that needs adaption to fit your reality, but basically it is what you need to do to protect your website, so be creative
if you are not experienced with htaccess functionality, feel free and contact us, we can help, with a real and immediate solution
and, this time I can not avoid adding a smarta?? comment, it does not help when you are already bitten, but the truth is, if you had our Metro Framework installed, you wouldn’t worry a thing, hakka Security Checks and hakka Orthrus take care of your site security and also of your sleep …
in any case, the decision is yours and good luck with holding your site together
Leave a Reply