Critical SQL Injection Vulnerability in WordPress Affects Versions 6.9.x and 7.0.x

## Overview WordPress has disclosed a critical vulnerability identified as CVE-2026-63030. This issue affects versions 6.9.x prior to 6.9.5 and 7.0.x prior to 7.0.2. The vulnerability arises from a REST API batch endpoint route confusion issue. When combined with another vulnerability, CVE-2026-60137, it could lead to SQL injection and remote code execution. ## Technical Details The vulnerability stems from improper handling of routes in the REST API batch endpoint. An attacker can exploit this confusion to manipulate SQL queries. This is particularly dangerous when combined with the author__not_in WP_Query SQL injection vulnerability. Together, these issues enable an attacker to execute arbitrary SQL commands, potentially leading to full control over the affected WordPress instance. ## Impact Successful exploitation of CVE-2026-63030 could allow an attacker to perform SQL injection attacks. This could result in unauthorized access to sensitive data, modification of database content, or even remote code execution on the server. Given the high CVSS score of 9.8, this vulnerability poses a significant risk to WordPress installations that have not been updated. ## Mitigation Defenders should immediately update their WordPress installations to versions 6.9.5 or 7.0.2 or later. Regularly monitor for updates and apply security patches as they become available. Additionally, review server logs for any suspicious activity that may indicate exploitation attempts.