Paper/Archive/CVE-2026-63030

CVE-2026-63030

WordPress WordPress — WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

KEV · due 24 Jul EPSS 11%public exploit SSVC act CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 In CISA KEV+3030.0 EPSS percentile 95.8.958 × 2019.2 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Affected

ProductAffectedFixed inSource

WordPress6.9.0 – < 6.9.56.9.5CNA

WordPress7.0.0 – < 7.0.27.0.2CNA

Scores by source

WPScan (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

writeupgithub.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q advisorywordpress.org/news/2026/07/wordpress-7-0-2-release refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030 kevcisa.gov/known-exploited-vulnerabilities-catalog