CVE-2026-63030: WordPress Core Vulnerability Allows SQL Injection and RCE

## Overview CISA added CVE-2026-63030 to its Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026. This vulnerability exists in WordPress Core, specifically in versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2. The addition to the KEV list indicates a federal deadline for remediation due to evidence of active exploitation. ## Technical Details The vulnerability arises from a REST API batch endpoint route confusion issue. This can be exploited in conjunction with another vulnerability, CVE-2026-60137, which involves an SQL Injection via the author__not_in WP_Query parameter. Together, these vulnerabilities can allow an attacker to execute arbitrary SQL commands, leading to Remote Code Execution (RCE). ## Impact Successful exploitation of CVE-2026-63030 can lead to severe consequences, including unauthorized access to sensitive data and complete control over affected WordPress installations. Given the high CVSS score of 9.8, the risk is significant, particularly for websites that have not applied the latest patches. ## Mitigation Defenders should immediately upgrade WordPress installations to version 6.9.5 or 7.0.2 to mitigate this vulnerability. Regularly updating software and monitoring for unusual activity can help prevent exploitation. Additionally, consider implementing web application firewalls (WAF) to provide an additional layer of security against SQL injection attacks.