CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-07-21. EPSS: 10.6% chance of exploitation in the next 30 days.

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Affected products

• WordPress WordPress: from 6.9, before 6.9.5 (fixed in 6.9.5); from 7.0, before 7.0.2 (fixed in 7.0.2)

Published 2026-07-17. Last modified 2026-10-08.