Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-63030: WordPress 6.9.x and 7.0.x - Remote Code Execution Risk
CVE-2026-63030
CVE-2026-63030
Summary
Certain versions of WordPress are vulnerable to a remote code execution attack through its REST API. This can happen if an attacker exploits a SQL injection flaw in the way WordPress handles certain queries. To stay safe, update your WordPress installation to the latest version, specifically 7.0.2 or later, to patch this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| wordpress | wordpress | < 6.9.5 |
Original title
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), c...
Original description
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
nvd CVSS3.1
7.5
Vulnerability type
CWE-436
Published: 17 Jul 2026 · Updated: 18 Jul 2026 · First seen: 17 Jul 2026