CVE-2026-63030 | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affec… | CVSS 7.5 HIGH

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Metadata

CVE ID: CVE-2026-63030
State: PUBLISHED
Assigner: WPScan
Reserved: 2026-07-17 17:17 UTC
Published: 2026-07-17 19:14 UTC
Last updated: 2026-07-17 19:49 UTC
Primary CWE: CWE-436
CWE-436 Interpretation Conflict
Vendor / Product: WordPress / WordPress
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
WordPress	WordPress	—	6.9.0 < 6.9.5, 7.0.0 < 7.0.2

Weakness (CWE)

CWE	Source	Description
—	cna	CWE-436 Interpretation Conflict
CWE-436	adp	CWE-436 Interpretation Conflict

CVSS scores (1)

Score	Severity	Version	Source	Vector
7.5	HIGH	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (2)