CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Other sources
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 6.9.5 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 7.0.2 - Compensating control
If mitigations for the REST API batch endpoint route confusion / SQL injection to RCE issue are unavailable for a given asset, discontinue use of the affected WordPress product (per vendor instructions and BOD 26-04 guidance).
- Operational
Evaluate each WordPress asset’s internet exposure and ensure adherence to CISA BOD 26-04 patching guidelines (Prioritizing Security Updates Based on Risk) and CISA “Forensics Triage Requirements” as part of the remediation process.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63030?
The severity of CVE-2026-63030 is high, with a CVSS score of 7.5.
What issues does CVE-2026-63030 exploit?
CVE-2026-63030 exploits a REST API batch endpoint route confusion leading to SQL injection and potentially remote code execution.
How do I fix CVE-2026-63030?
To fix CVE-2026-63030, update WordPress to version 7.0.2 or later.
What versions of WordPress are affected by CVE-2026-63030?
WordPress versions prior to 7.0.2, specifically 6.9.x before 6.9.5 and 7.0.x before 7.0.2, are affected by CVE-2026-63030.
Can CVE-2026-63030 lead to data compromise?
Yes, CVE-2026-63030 can lead to potential data compromise through SQL injection vulnerabilities.