Security Alert Summary
WordPress versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2 are affected by a REST API batch endpoint route confusion issue which, when combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL injection and achieve remote code execution.
CVE Details
- CVE ID: CVE-2026-63030
- Affected component: WordPress (REST API batch endpoint route confusion)
- Affected versions:
- 6.9.0 < 6.9.5 (6.9.x before 6.9.5)
- 7.0.0 < 7.0.2 (7.0.x before 7.0.2)
- Published: July 17, 2026 at 8:17:28 PM UTC
- Last modified: July 18, 2026 at 5:16:56 AM UTC
- CVSS v3.1 (entry 1): Base Score 9.8, Severity CRITICAL, Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 (entry 2): Base Score 7.5, Severity HIGH, Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication / Privileges / User Interaction: Privileges Required: NONE; User Interaction: NONE (per CVSS entries)
- Primary impact: Confidentiality: HIGH (possible exposure of sensitive data); Integrity: HIGH or NONE depending on scoring entry; Availability: HIGH or NONE depending on scoring entry
- CWE / weakness ID: CWE-436
Technical Details
The issue is a route confusion in the REST API batch endpoint. By itself this route confusion can cause requests to be routed in unexpected ways. When this behavior is combined with an existing SQL injection in the author__not_in handling in WP_Query (tracked as CVE-2026-60137), an attacker can craft requests that trigger SQL injection via the exposed route. The CVE description indicates that successful exploitation of the combined issues can allow execution of SQL injection leading to remote code execution.
No additional functions, endpoints, or checks are named in the provided data beyond the REST API batch endpoint and the author__not_in WP_Query vector. The impact described is limited to the capabilities indicated: SQL injection with potential to achieve remote code execution when both issues are present.
How This Could Impact Your Website
Consider a small organization where the site owner manages plugin and theme updates, an editor or internal staff member publishes content, and an external contractor or contributor provides content via contributor accounts. If an attacker can exploit the described route confusion together with the author__not_in SQL injection, the attacker could target database queries to access sensitive site data, including user records.
Practical consequences may include exposure of internal user email addresses or other confidential data, which increases the risk of targeted phishing or social engineering against staff and contractors. Depending on successful follow-on actions, the vulnerability description also indicates a potential path to remote code execution.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update WordPress to a patched version as soon as a fixed release is available.
- Review and reduce unnecessary user roles and capabilities, especially contributor roles that may be able to interact with REST endpoints.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes to reduce attack surface.
- Monitor site activity and logs for unusual behavior, including unexpected REST API requests.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
