Skip to content
>_ITDITDWeb Security Platform

Threat feed

CriticalCVSS9.8#CVE-2026-63030#CVE-2026-60137#WordPress#SQL injection#RCE

CVE-2026-63030 / CVE-2026-60137 — Unauthenticated SQLi to RCE in WordPress core (explainer & fixes)

CVE-2026-63030: a WordPress core REST API 'route confusion' flaw that, chained with the WP_Query author__not_in SQL injection (CVE-2026-60137), reaches unauthenticated SQLi → RCE. CVSS 9.8 and actively exploited (CISA KEV). The real fix: update core to 6.8.6 / 6.9.5 / 7.0.2, plus a compromise check.

Published 2026-07-21 Last verified 2026-07-21 4 min read

A defensive advisory for vulnerabilities with confirmed in-the-wild exploitation (listed in CISA KEV). What happens, what's affected, and how to respond — with no attack how-to or proof-of-concept.

Advisory summary
CVE
CVE-2026-63030 (route confusion, CWE-436) + chained CVE-2026-60137 (SQLi, CWE-89)
Severity
Critical (CVSS 9.8) — actively exploited (CISA KEV; remediation due 2026-08-04)
Type
REST API route confusion × author__not_in SQL injection → unauthenticated SQLi → RCE
Impact
Unauthenticated SQL injection, remote code execution (RCE), data theft
Affected
WordPress core 6.8.x / 6.9.x / 7.0.x (before each fix)
Real fix
Update to 6.8.6 / 6.9.5 / 7.0.2 or later
9.8
CVSS / worst class
No auth
Reachability (when chained)
SQLi→RCE
Reachable impact
6.8.6/6.9.5/7.0.2
The real block

Why not-patching is dangerous

Because RCE is reachable without authentication, public WordPress sites are hit en masse by blind scanning. This is a flaw in core — not limited to a specific plugin — so every site on an affected version is potentially in scope. CISA ordered federal agencies to remediate by 2026-08-04. "We're too small to be targeted" does not hold.

What's affected

ItemDetail
TargetWordPress core
Affected versions6.8.0–6.8.5 (60137) / 6.9.0–6.9.4 / 7.0.0–7.0.1
Fixed version6.8.6 / 6.9.5 / 7.0.2 and later
PreconditionNo authentication when chained
Reachable impactSQL injection → remote code execution (RCE); data theft
StatusBoth actively exploited (CISA KEV; remediation due 2026-08-04)

A note on the differing severity scores (both sides)

The severity of CVE-2026-60137 on its own differs by source. WPScan rates it CVSS 5.9 (on its own it needs a plugin/theme to pass untrusted input to author__not_in — a reachability precondition), while CISA rates it 9.1. Chained with CVE-2026-63030's route confusion, it becomes reachable directly via the REST API and effectively exploitable without authentication (CVSS 9.8). The difference reflects how each scores the reachability precondition; the response is the same — update to the fixed release.

How to respond

1

Update core to 6.8.6 / 6.9.5 / 7.0.2+ (top priority, the real fix)

Update WordPress core to the patched version — the real block on RCE. Minor auto-updates are on by default, but many sites disable them, so confirm the version actually running.
2

Check for compromise (assume you were reached before updating)

Look for unexpected admin accounts, unfamiliar plugins/themes, tampered core/plugin files, suspicious outbound traffic, and unauthenticated hits on the REST API batch endpoint. Treat SQLi→RCE as "the whole DB (users, secrets) may have leaked."
3

Buy time until you can update (defense-in-depth)

If you can't update immediately, restrict access to the REST API batch endpoint and use a WAF to lower the blast radius. Keep the app's DB user on least privilege. This is time-buying; the real fix is the update.
4

Machine-monitor CVEs for core, plugins, and themes

Monitor the versions and CVEs of WordPress core and all plugins/themes, and update promptly when advisories publish. This structurally prevents "a known public CVE gets missed and left unpatched."

This site's take: design as if every input is untrusted

At its core, this flaw is untrusted input reaching a query through an unexpected path (route confusion). SQL injection is designed out by always using placeholders (prepared statements) and always sanitizing/validating input regardless of the path or assumed preconditions. The single update is mandatory, but what pays off long-term is a "trust no input" design plus a routine that machine-monitors core/plugin CVEs and updates quickly.

FAQ

QWhat does CVE-2026-63030 let an attacker do?
A

A 'route confusion' flaw in WordPress core's REST API batch endpoint, combined with the WP_Query author__not_in SQL injection (CVE-2026-60137), lets an unauthenticated attacker perform SQL injection and ultimately reach remote code execution (RCE). That leads directly to data theft, defacement, secretly minted admin accounts, and pivoting to other systems. It is a worst-case flaw: CVSS 9.8, with confirmed in-the-wild exploitation (CISA KEV).

QWhat's the surest fix?
A

Update WordPress core to 6.8.6 (6.8.x), 6.9.5 (6.9.x), or 7.0.2 (7.0.x) or later. Both CVEs are fixed in that same release. WordPress enables automatic minor updates by default, but many sites disable them — so confirm the version actually running. Until you can update, restrict access to the REST API batch endpoint and use a WAF in layers.

QHow does it relate to CVE-2026-60137, and why do sources rate the severity differently?
A

CVE-2026-60137 is a SQL injection from insufficient sanitization of the author__not_in parameter; on its own it requires a plugin or theme to pass untrusted input (so WPScan rates it CVSS 5.9). Chained with CVE-2026-63030's route confusion, it becomes reachable directly via the REST API and exploitable without authentication, at CVSS 9.8 (CISA rates 60137 itself 9.1). The difference is how each scores the reachability precondition. Both are fixed in the same release, so the response is simply: update core.