CVE-2026-63030

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Oct 8, 2026

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-436

Affected software

Vendor	Product	Versions
WordPress	WordPress	>= 6.9.0, < 6.9.5; >= 7.0.0, < 7.0.2

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662qVendor Advisory
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030US Government Resource

Timeline

Published: Jul 17, 2026
Last modified: Oct 8, 2026
Added to CISA KEV: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-630336.5A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAdd CVE-2026-630358.1A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial CVE-2026-630379.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow S CVE-2026-630389.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker CVE-2026-630399.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker CVE-2026-63048.3Use after free in Graphite in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to po CVE-2026-630408.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authen CVE-2026-630418.8Reliance on Untrusted Inputs in a Security Decision vulnerability in Apache APISIX. This vulnerability allows an attacker to escalate privi CVE-2026-630428.1Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create,CVE-2026-630437.5Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLon CVE-2026-630445.4Server-Side Request Forgery (SSRF) vulnerability in Apache InLong. Any authenticated user (no admin role required) can cause the InLong Man CVE-2026-630457.5Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfo