critical·Product Based Web Vulnerabilities·Updated Jul 18, 2026

WordPress Core 6.9-7.0.1 - Pre-Auth Blind SQL Injection (Batch-Route Confusion)

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVECVE-2026-63030

9.8

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

WordPressby WordPress

AFFECTED< 6.9.5→SAFE ✓≥ 6.9.5

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

WordPress Core 6.9-7.0.1 - Pre-Auth Blind SQL Injection (Batch-Route Confusion)

Check your infrastructure.Right now.

Check your infrastructure.
Right now.