PlatformPlansPartners
Resources
ToolsBlogDocs
Labs
CVE ForecastOpservantAll Research →
Sign Up →
critical·Product Based Web Vulnerabilities·Updated Jul 18, 2026

WordPress Core 6.9-7.0.1 - Pre-Auth Blind SQL Injection (Batch-Route Confusion)

Est. Time~10 seconds
Scan TypeGroup Scan
Targetsdomain, subdomain, ipv4
CostFree
2.5k
Times Used
continuous scan runs
0
Continuously Checked
assets under CS
0
Vulnerabilities Found
confirmed findings
References
🔴
CISA Known Exploited Vulnerability
This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.
CVECVE-2026-63030
9.8
CVSScritical
Exploitable remotely over the internet · no authentication required.

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Attack Vector
Network
Privileges Req.
None
User Interaction
None
Affected
WordPressby WordPress
AFFECTED< 6.9.5→SAFE ✓≥ 6.9.5
Updated Sep 9, 2026View on NVD →
Similar Tools
high
WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload
→critical
WordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation
→medium
WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting
→medium
Wordpress Jetpack plugin - Server Side Request Forgery
→high
WordPress Backup Migration <= 1.3.6 - Path Traversal
→medium
WordPress Qubely < 1.8.6 - Unauthenticated Email Sending
→medium
WordPress Popup Builder <= 4.1.11 - Cross-Site Request Forgery
→critical
WordPress AI ChatBot (WPBot) <= 4.8.9 - SQL Injection
→

Check your infrastructure.
Right now.

11,000+ scanners. Free to start. No credit card required.