CVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (C

CSIRTS triage

What

WordPress versions before 6.9.5 and 7.0.2 are affected by a REST API batch endpoint route confusion issue.

Who is affected

Users of WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are affected.

Urgency

Remediation is critical due to active exploitation and the potential for remote code execution.

Action

Update WordPress to version 6.9.5 or 7.0.2.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

NVD Recent CVEs (US · database · site)

Severity

critical — CVSS 9.8

Published

2026-07-17

Last updated

2026-07-22

Exploitation

Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-63030

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Exploitation confirmedCVE-2026-63030Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• critical[NEW] [critical] WordPress: Multiple vulnerabilities allow code executioncert-bund
• unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
• highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
• criticalexploitedCVE-2026-63030: WordPress Core Interpretation Conflict Vulnerabilitycisa-kev
• unknownWordPress Multiple Vulnerabilitieshkcert
• unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
• unknownMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-avis
• unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl

Recent advisories for WordPress

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• mediumCVE-2026-6453: The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to …nvd · 2026-08-01
• mediumCVE-2026-18435: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
• mediumCVE-2026-18344: The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site …nvd · 2026-08-01
• mediumCVE-2026-18062: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
• mediumCVE-2026-18059: The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to…nvd · 2026-08-01
• mediumCVE-2026-17605: The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vul…nvd · 2026-08-01

More from NVD Recent CVEs

• mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
• mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
• mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
• highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
• mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01