CVE-2026-63030: listed in the CISA KEV catalog CVE-2026-63030 · CVSS 7.5 HIGH · KEV 2026-07-21
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Is CVE-2026-63030 exploited? Listed in the CISA KEV catalog on 2026-07-21. Federal remediation due 2026-07-24. Past that date by 22 days. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2026-63030 Primary sources What this record does not say No EPSS score. No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.
CVE-2026-63030: listed in the CISA KEV catalog CVE-2026-63030 · CVSS 7.5 HIGH · KEV 2026-07-21
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
Is CVE-2026-63030 exploited? Listed in the CISA KEV catalog on 2026-07-21. Federal remediation due 2026-07-24. Past that date by 22 days. Public exploit code: packaged in a public tool. Public detection rules exist. Which products and versions are affected? No affected package list recorded here yet.
Is there a patch? No patch identifier recorded here yet.
What PlainSec published about CVE-2026-63030 Primary sources What this record does not say No EPSS score. No affected package data. No patch identifier. KEV and EPSS are re-checked daily. Record last updated 2026-08-11.