NCSC-VD-2607-002-02
الرقم المرجعي: NCSC-VD-2607-002-02
WordPress
الوصف
CVE-2026-63030: REST API batch-route confusion in WordPress 6.9 and later can be chained with the SQL injection issue CVE-2026-60137 to achieve remote code execution. Fixed in 6.9.5, 7.0.2 and 7.1 beta2.
CVE-2026-60137: SQL injection in the author__not_in parameter of WP_Query affects WordPress 6.8 and later. In WordPress 6.9 and later it can be chained with CVE-2026-63030 for remote code execution. Fixed in 6.8.6, 6.9.5, 7.0.2 and 7.1 beta2.
الثغرات
- CVE-2026-63030
REST API batch-route confusion in WordPress 6.9 and later can be chained with the SQL injection issue CVE-2026-60137 to achieve remote code execution. Fixed in 6.9.5, 7.0.2 and 7.1 beta2.
- CVE-2026-60137
SQL injection in the author__not_in parameter of WP_Query affects WordPress 6.8 and later. In WordPress 6.9 and later it can be chained with CVE-2026-63030 for remote code execution. Fixed in 6.8.6, 6.9.5, 7.0.2 and 7.1 beta2.