Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:37226a620212668683032a0730a67c1794b5bce1c9ac08f6e2fe2cb81da40298
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 2 assertions

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/adp/0/metrics/0/cvssV3_1

{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/metrics/0/cvssV3_1
cwe · 2 assertions

{"description":"CWE-436 Interpretation Conflict","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-436","description":"CWE-436 Interpretation Conflict","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/adp/0/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"WordPress","vendor":"WordPress","versions":[{"lessThan":"6.9.5","status":"affected","version":"6.9.0","versionType":"semver"},{"lessThan":"7.0.2","status":"affected","version":"7.0.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/affected/0

Provider-owned CVSS observations

2 source assertions
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/adp/0/metrics/0/cvssV3_1
{"metric":{"baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"description":"CWE-436 Interpretation Conflict","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-436","description":"CWE-436 Interpretation Conflict","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/adp/0/problemTypes/0/descriptions/0

Known exploitation assertions

2 source assertions
{"cwes":["CWE-436"],"dateAdded":"2026-07-21","dueDate":"2026-07-24","knownRansomwareCampaignUse":"Unknown","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","product":"Core","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance …
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:9be25a55ee7dd1e5884fd9b4e910839a3a0c2cbb7d533d155f8fd3b7b3e52fb1 · sha256:635dff916c4092c0… · /vulnerabilities/10
    Open source location →
{"cwes":["CWE-436"],"dateAdded":"2026-07-21","dueDate":"2026-07-24","knownRansomwareCampaignUse":"Unknown","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","product":"Core","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance …
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:293305cd41de04c27e172deaa439a16bf1c684ffcf46a93b0888098413a4c33d · sha256:16acee8334e59e44… · /vulnerabilities/7
    Open source location →

Source references

3 source assertions
{"tags":["vdb-entry","technical-description"],"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/references/0
{"tags":["release-notes","vendor-advisory"],"url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/cna/references/1
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:7a3cd2ec433de74cb0d942efe8be882c74d37d3f690b2725f68d7922004f2f3e · sha256:f6986c06c01b503c… · /containers/adp/0/references/0

Attribution and limitations

  • CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer