Skip to content
Log inStart free trial

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in…

Critical Known exploited
Severity
9.8 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
10.65%
Chance of exploitation in the next 30 days. Higher than 95.80% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jul 21, 2026
Weakness
CWE-436 Interpretation Conflict
Fix
None yet
No fixed version published
Exploited in the wild. WordPress Core Interpretation Conflict Vulnerability (WordPress Core). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due for U.S. federal agencies by Jul 24, 2026.

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

How to fix

No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.

Severity breakdown

CVSS 3.1 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Weakness

CWE-436: Interpretation Conflict

Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

References

Advisories

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-5x38-2vff-x55p
Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
High Same weakness, CWE-436
GHSA-9v7c-q64q-vv33
Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
Medium Same weakness, CWE-436
GHSA-pq4g-8rxf-4g29
Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
Medium Same weakness, CWE-436
GHSA-m665-v7pm-7grj
zip: Critical Parser Differential & Security Control Bypass via Dual-Header Inconsistencies (Zip Cloaking) Leading to Arbitrary File Overwrite & RCE
Critical Same weakness, CWE-436
EEF-CVE-2026-115700
SSRF allowlist bypass via percent-encoded bracketed IPv6 or trailing-dot IP literal in hackney
Not rated yet Same weakness, CWE-436
GHSA-8c8m-p3m8-cjg8
Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
Medium Same weakness, CWE-436
GHSA-m943-m63m-w62w
Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
Medium Same weakness, CWE-436
GHSA-85x2-q946-cp5h
Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
Medium Same weakness, CWE-436
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor