WordPress Vulnerabilities

WordPress < 7.0.2 - REST API batch-route confusion and SQLi to RCE

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Affects WordPress

7.0.1
Fixed in WordPress 7.0.2
7.0
Fixed in WordPress 7.0.2
6.9.4
Fixed in WordPress 6.9.5
6.9.3
Fixed in WordPress 6.9.5
6.9.2
Fixed in WordPress 6.9.5
6.9.1
Fixed in WordPress 6.9.5
6.9
Fixed in WordPress 6.9.5

References

CVE
CVE-2026-63030
URL
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
URL
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q

Miscellaneous

Original Researcher
Adam Kues (Assetnote / Searchlight Cyber)
Verified
Yes
WPVDB ID
73310d64-e790-4a78-ab0a-12995b762dba

Timeline

Publicly Published
2026-07-17 (about 1 month ago)
Added
2026-07-20 (about 1 month ago)
Last Updated
2026-07-20 (about 1 month ago)

Other

Published
Title
Published
2019-01-10
Title
Ninja Forms < 3.3.21.3 - XSS and SQLi
Published
2018-11-05
Title
Media File Manager <= 1.4.2 - Authenticated Multiple Vulnerabilities
Published
2019-09-30
Title
Theme Editor < 2.2 - Multiple Vulnerabilities
Published
2019-10-30
Title
Give WP < 2.5.10 - Multiple Issues
Published
2017-11-13
Title
Formidable Forms < 2.05.03 - Multiple Vulnerabilities