CVE Vulnerability Advisory Database

[Affected Scope] WordPress Core versions 4.7 through 7.1.3

[Impact] Unauthenticated attackers can execute arbitrary code on the server by exploiting predictable staging paths during the core upgrade process

[Mitigation] Immediately upgrade to WordPress 7.1.4 or later and restrict web access to the upgrade staging directories

[Affected Scope] All WordPress installations running vulnerable core versions and specific themes.

[Impact] Unauthenticated attackers can include and execute arbitrary local PHP files, leading to full server compromise.

[Mitigation] Immediate update to the latest WordPress security release and deployment of WAF filtering rules.

[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2

[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)

[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules

[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)

[Impact] Successful exploitation allows remote attackers to execute arbitrary SQL commands and retrieve sensitive database information when a plugin or theme passes untrusted input to the 'author__not_in' parameter of WP_Query.

[Mitigation] Immediately upgrade WordPress core to the patched versions (6.8.6, 6.9.5, or 7.0.2) and apply WAF filtering rules.