Hi @kvedder,
Thanks for reaching out. Give me a couple of days to look at this, I’m on vacation, and I’ll get back to you, seems like it’s just something in the script returning an error, but I’ll have to look at the code and your site to see what I can gather.
In the meantime, have you tried deactivating all other plugins to see if there’s a conflict, or switching to another theme?
Cheers,
Nate
It looks like it might be something bigger causing the issue. I am working with my hosting provider on it. I get a similar error each time I try to save any widget. Ill keep you posted,
Nice, thank you @kvedder !
@kvedder just checked out the code mentioned and it’s coming from a caught error, however, that could be from something else, usually when I see an error like that, HTML is coming back prematurely. In this case, it’s likely something else if you’re getting an error trying to save widgets.
Keep me posted.
I was able to disable ModSecurity and all of my other errors stopped happening. I am able to load the widget and save it successfully. However, no books load in the widget. I am guessing the JSON needs regenerated to populate the widget? I still get the error when attempting to regenerate JSON.
What can I send you to help you nail this down? I can get server logs, browser console…. whatever you need.
Ken
With the widget loading on the homepage. Console shows.
Error fetching posts: TypeError: NetworkError when attempting to fetch resource. view.js:1:6892
https://irondoxa.com/wp-content/plugins/my-reads/build/my-reads-listing/view.js?ver=d0f705d258b4b11fc529:1
-
This reply was modified 3 months ago by
kvedder.
I added some additional PHP modules to the server, strangely enough I would have expected to have needed to add the “json” module, but that was already installed. That seems to have fixed the widget on the homepage.
I think we’re good to go.
Thanks for responding while on vacation.
Hey Ken,
Awesome, yeah, seems to be working, I’ve never tested this in a Widget area, glad it’s working (can see it on your site, excellent!).
Holler if you need anything else.
Cheers,
Nate
I have the same problem. Disabling ModSecurity is not the solution; the problem persists. Servers block the IP address when attempting to save paragraph text added via the widget. The error message points to a JSON-related issue. I have tested this across multiple domains and various themes.
There’s a more serious problem in the code ;/
I’m counting on your help.
Regards
Hi @com2r thanks for reaching out. Can you help me out with some more context?:
- You’re trying to use the block in the Widget area?
- Or is this an issue on the frontend?
- Do you have any screenshots you can share with me of the issue or the error message from JS console or PHP server?
- Have you tried deactivating other plugins and switching to a default theme to see if this works?
- Do you have any public links I can take a look at?
Thanks for your help, I appreciate it!
Log from server
query line: OPTIONS /wp-json/batch/v1?_locale=user HTTP/1.1
Message: WordPress wp2shell: REST batch route-confusion attempt detected
Log from host:
{
"transaction": {
"unique_id": "RVPvbwaSnGIOiB@@kHeBeVxc",
"time_stamp": "Wed Sep 9 16:17:17 2026",
"client_ip": "123.45.67.89",
"client_port": 58568,
"host_ip": "91.236.131.77:443",
"host_port": 443,
"request": {
"method": "OPTIONS",
"http_version": "HTTP/1.1",
"uri": "/wp-json/batch/v1?_locale=user",
"headers": {
"host": "example.com",
"x-wp-nonce": "[ZANONIMIZOWANE]",
"user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/151.0.0.0 Safari/537.36",
"origin": "https://example.com",
"referer": "https://example.com/wp-admin/widgets.php",
"cookie": "[ZANONIMIZOWANE_COOKIES]"
}
},
"response": {
"http_code": 406
},
"messages": [
{
"message": "WordPress wp2shell: REST batch route-confusion attempt detected",
"details": {
"ruleId": 1006318,
"file": "/etc/seohost/modsec/cve_wordpress_core.conf",
"msg": "WordPress wp2shell: REST batch route-confusion attempt detected",
"severity": "CRITICAL",
"tags": [
"application-wordpress",
"attack-rce",
"wp2shell-route-confusion",
"CVE-2026-63030"
]
}
}
]
}
}
Thanks for the logs.
It could be that this is a false positive in your server’s ModSecurity ruleset, not a bug in the plugin or in WordPress core. Rule 1006318 is meant to catch attacks on the batch endpoint that CVE-2026-63030 targets, but the block editor uses that same endpoint for normal saves. The rule fires, the server returns a 406 error page, the editor tries to parse that as JSON, and you get the error.
That rule is your host’s, not WordPress’ or my rule, which is also why the ModSecurity toggle may not help, since it often doesn’t reach rules enforced upstream.
It might be worth opening a ticket with your hosting provider: “rule 1006318 is blocking my own authenticated requests to /wp-json/batch/v1 in the editor, please whitelist it for this site.” Include the audit log entry with the client IP address, so they can see the blocked request came from you while logged in. That’s what shows it’s a false positive rather than a real attempt.
Before you do that, however, it would be good to make sure it’s not another plugin or theme causing the issue. It’s usually best practice to switch off all plugins except the one in question (mine, in this case), and reactivate the other plugins one a time to see if there’s a conflict somewhere. You should also try the same with switching themes.
Let me know how that all goes.
Nate
