Full Report
WordPress security advisory (AV26-723)
Analysis Summary
# Vulnerability: Multiple Critical WordPress Core SQL Injection and RCE
## CVE Details
- **CVE ID:** CVE-2026-60137 (SQL Injection), CVE-2026-63030 (Batch-Route Confusion/RCE)
- **CVSS Score:** Not specified in advisory (Estimated 8.8 - 9.8 based on RCE/SQLi impact)
- **CWE:** CWE-89 (SQL Injection), CWE-94 (Code Injection)
## Affected Systems
- **Products:** WordPress Core
- **Versions:**
- 7.1 beta prior to 7.1 beta2
- 7.0 prior to 7.0.2
- 6.9 prior to 6.9.5
- 6.8 prior to 6.8.6
- **Configurations:** Standard installations; specifically those utilizing REST API batch processing or complex `WP_Query` calls involving the `author__not_in` parameter.
## Vulnerability Description
This advisory covers two critical flaws:
1. **`WP_Query` SQL Injection:** A failure to properly sanitize the `author__not_in` parameter allows an attacker to inject malicious SQL commands via the application's query engine.
2. **REST API Batch-Route Confusion:** A logic error in how the WordPress REST API handles batched requests. This confusion can be leveraged to bypass security checks, leading to SQL Injection and ultimately **Remote Code Execution (RCE)** on the underlying server.
## Exploitation
- **Status:** **Exploited in the wild.** Active exploitation reported for both CVE-2026-60137 and CVE-2026-63030.
- **Complexity:** Medium (Requires specific API request formatting)
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full database access and file system access)
- **Integrity:** High (Ability to modify any site content or system files)
- **Availability:** High (Potential for site takeover or deletion)
## Remediation
### Patches
WordPress has released security updates for all supported branches. Users should update immediately to:
- **7.1 beta 2**
- **7.0.2**
- **6.9.5**
- **6.8.6**
### Workarounds
- No official functional workarounds are provided.
- Disabling the REST API may mitigate CVE-2026-63030 but will break significant site functionality (including the Block Editor).
- Implementing a Web Application Firewall (WAF) with rules targeting SQL injection patterns in the `author__not_in` parameter may provide temporary relief.
## Detection
- **Indicators of Compromise:** Monitor web server access logs for unusual POST requests to `/wp-json/batch`. Inspect for encoded SQL commands or unexpected sequences in the `author__not_in` query parameter.
- **Detection methods and tools:** Utilize vulnerability scanners (e.g., WPScan) updated with the latest definitions for these CVEs. Review file integrity for unauthorized changes to core files or newly created PHP scripts in the `wp-content/uploads` directory.
## References
- hxxps[://]github[.]com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
- hxxps[://]github[.]com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
- hxxps[://]wordpress[.]org/news/2026/07/wordpress-7-0-2-release/
- hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/wordpress-security-advisory-av26-723