Skip to main content
عربي
logo

NCSC-VD-2607-002-02

Severity Level: Critical

Reference No.: NCSC-VD-2607-002-02

WordPress

Description

CVE-2026-63030: REST API batch-route confusion in WordPress 6.9 and later can be chained with the SQL injection issue CVE-2026-60137 to achieve remote code execution. Fixed in 6.9.5, 7.0.2 and 7.1 beta2.

CVE-2026-60137: SQL injection in the author__not_in parameter of WP_Query affects WordPress 6.8 and later. In WordPress 6.9 and later it can be chained with CVE-2026-63030 for remote code execution. Fixed in 6.8.6, 6.9.5, 7.0.2 and 7.1 beta2.

Vulnerabilities

  • CVE-2026-63030

    REST API batch-route confusion in WordPress 6.9 and later can be chained with the SQL injection issue CVE-2026-60137 to achieve remote code execution. Fixed in 6.9.5, 7.0.2 and 7.1 beta2.

  • CVE-2026-60137

    SQL injection in the author__not_in parameter of WP_Query affects WordPress 6.8 and later. In WordPress 6.9 and later it can be chained with CVE-2026-63030 for remote code execution. Fixed in 6.8.6, 6.9.5, 7.0.2 and 7.1 beta2.

References