On July 17, 2026, WordPress released fixes for CVE-2026-63030, REST API batch-route confusion and SQL injection leading to remote code execution, and a separate SQL injection, CVE-2026-60137. The earlier claims about a single anonymous request and exact proof-of-concept counts within 24 hours were not established by the primary sources used here and are withdrawn.
Immediate Actions to Take
- ✓Update 6.9 installations to a fixed release starting at 6.9.5 and 7.0 installations to 7.0.2 or later
- ✓Update 6.8 installations to 6.8.6 or later for the separate SQL-injection fix
- ✓Verify the actual running version and completed update, not only the auto-update setting
- ✓Review unexpected administrators, file changes, and access logs
Vulnerability Overview and Scope of Impact
CVE-2026-63030 affects 6.9.0–6.9.4 and 7.0.0–7.0.1; fixes are 6.9.5 and 7.0.2. CVE-2026-60137 concerns untrusted input reaching WP_Query's author__not_in parameter and also affects 6.8.0–6.8.5. The 6.8 branch is not affected by both issues. The release announcement identifies 7.1 beta2 as fixed and says versions before 6.8 are unaffected by these two flaws. That does not establish that older versions are safe from other vulnerabilities.
The displayed score for CVE-2026-63030 is WPScan CNA's CVSS v3.1 assessment, 9.8 CRITICAL. Severity and evidence of observed exploitation are separate questions. WordPress enabled forced automatic updates because of severity; that action does not itself prove that attacks occurred.
Specific Impact and Attack Scenarios
The REST API routing flaw and SQL injection can combine to execute code on a site. Suspected compromise warrants investigation of content changes and data access. The separate advisory for CVE-2026-60137 describes a prerequisite involving a theme or plugin passing untrusted input to WP_Query. Do not conflate the conditions of these two vulnerabilities.
Remediation Steps and Verification Methods
Back up files and the database, install a fixed release for the deployed branch, and test themes and important plugins. Patching does not remove an existing compromise. If unexpected administrators or modifications appear, preserve logs and coordinate incident response with the hosting provider.
The previous Nginx example was not substantiated as an official WordPress workaround and is withdrawn. REST API requests have multiple entry paths, so blocking a guessed path does not establish complete protection. If updating is impossible, ask the hosting provider about temporary measures, including whether the service should be taken offline.
📦