CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-07-17
WordPress REST API Route Confusion and SQL Injection Chaining Remote Code Execution Vulnerability (CVE-2026-63030)
[Affected Scope] WordPress versions 6.9.x before 6.9.5, and 7.0.x before 7.0.2
[Impact] Unauthenticated attackers can exploit a REST API batch endpoint route confusion vulnerability, chaining it with the WP_Query SQL Injection (CVE-2026-60137) to compromise the database and achieve Remote Code Execution (RCE)
[Mitigation] Immediately upgrade WordPress core to patched versions (6.9.5, 7.0.2, or later), or temporarily disable the REST API batch endpoint and apply WAF rules