WordPress REST API Route Confusion and SQL Injection Chaining Remote Code Execution Vulnerability (CVE-2026-63030)

1. Apply Official Security Patches

The primary remediation is to upgrade the WordPress core to the latest secure releases.

• WordPress 6.9 Branch: Upgrade to 6.9.5 or higher
• WordPress 7.0 Branch: Upgrade to 7.0.2 or higher

2. Temporary Mitigations

If immediate patching is not feasible, implement the following workarounds to reduce the attack surface:

A. Disable the REST API Batch Endpoint

Add the following code snippet to your active theme's functions.php file or a custom utility plugin to disable the batch endpoint:

add_filter('rest_endpoints', function($endpoints) {
    if (isset($endpoints['/batch/v1'])) {
        unset($endpoints['/batch/v1']);
    }
    return $endpoints;
});

B. Web Application Firewall (WAF) Rules

Configure your WAF to block suspicious payloads targeting the /wp-json/batch/v1 endpoint, specifically monitoring for SQL injection patterns and malicious use of the author__not_in parameter.

This vulnerability stems from a route confusion issue (CWE-436) within the WordPress REST API batch request processing mechanism.

An attacker can leverage the batch endpoint to bypass route restrictions or authorization checks. When combined with CVE-2026-60137—a SQL injection vulnerability residing in the author__not_in parameter of WP_Query—the impact escalates significantly.

By chaining these vulnerabilities, an unauthenticated remote attacker can execute arbitrary SQL queries to extract sensitive database contents (such as administrator sessions and password hashes) and ultimately achieve full Remote Code Execution (RCE) on the underlying server. Due to active exploitation in the wild, this vulnerability has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.