UpHeron
All vulnerabilities

WordPress core

CVE-2026-63030

REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 21 Jul 2026.

Severity
Critical 9.8
Published
17 Jul 2026
Last changed
8 Oct 2026
Added to UpHeron
17 Oct 2026
Fixed in
6.9.5, 7.0.2
Also known as
GHSA-ff9f-jf42-662q
Sources
NVD, WordPress

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • From 6.9 before 6.9.5
  • From 7.0 before 7.0.2

Known exploited

CISA name
WordPress Core Interpretation Conflict Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
24 Jul 2026
Used in ransomware
Not known

References