CVE-2026-63030

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

critical · 9.8

Known exploited

Fix listed

WordPress

Published Jul 17, 2026, 19:14 UTC

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Reported fixed versions

6.9.5, 7.0.2

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.