Critical · published July 18, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 95.8th percentile for exploit probability.
🚨 A sneaky route confusion in WordPress could unleash chaos! Just two vulnerabilities combined allow attackers to execute SQL injections and gain remote code execution. 🔥 Think of it like a postal service misrouting packages — the delivery person has no idea where to send the important documents, leading to potentially sensitive info landing in the wrong hands. That's exactly how attackers can exploit this REST API issue! An attacker could infiltrate your WordPress site, execute arbitrary code, and wreak absolute havoc — think stolen data, defaced pages, or even complete server takeover. The potential for damage is absolutely devastating, making this a critical situation!
Think of it like a postal service misrouting packages — the delivery person has no idea where to send the important documents, leading to potentially sensitive info landing in the wrong hands. That's exactly how attackers can exploit this REST API issue! The CVE-2026-63030 vulnerability in WordPress stems from a REST API batch endpoint route confusion issue. This flaw, when combined with the author__not_in WP_Query SQL Injection vulnerability, allows attackers to manipulate SQL queries and run arbitrary commands on the server.
CVE-2026-63030's CNA description states the REST API batch endpoint route confusion is exploitable "combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137)".
An attacker could infiltrate your WordPress site, execute arbitrary code, and wreak absolute havoc — think stolen data, defaced pages, or even complete server takeover. The potential for damage is absolutely devastating, making this a critical situation! Immediately update WordPress to version 6.9.5 or 7.0.2 to patch this vulnerability. It’s also a good idea to audit your plugins and themes for any outdated components that may exacerbate the risk. Ensure you have robust security measures in place! You've got this! Follow these steps, and you'll lock down your site in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| wordpress/wordpress | ≥ 6.9, < 6.9.5 | 6.9.5 |
| wordpress/wordpress | ≥ 7.0, < 7.0.2 | 7.0.2 |