CVE-2026-63030

WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

CVSS 9.8 critical · WordPress WordPress · published 2026-07-17

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

NVD · CVE.org

Coverage 1 source

1. 2026-07-21 CISA Cybersecurity Advisories high CISA Adds Four Known Exploited Vulnerabilities to Catalog

   CISA added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation.

Mentioned with

CVE-2021-27137 CVE-2026-0770 CVE-2026-60137

Also covered

• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 1 article · 2026-09-29
• CVE-2023-6548 Cloud Software Group NetScaler ADC CVSS 5.5 · 1 article · 2026-09-28
• CVE-2023-25608 Fortinet FortiAP-W2 CVSS 5.2 · 1 article · 2026-09-28
• CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVSS 9.5 · 3 articles · 2026-09-28
• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 3 articles · 2026-09-28