Detection of Multiple Vulnerabilities in the WordPress Core Affecting Security
WordPress has published two vulnerabilities in its core, rated with critical and high severities. These WordPress Core vulnerabilities could allow a remote attacker to execute arbitrary code on the server or access sensitive information stored in the database through SQL injection attacks.
Description of Detected Vulnerabilities
The vulnerability identified as CVE-2026-63030 affects the /wp-json/batch/v1 endpoint of the WordPress REST API. It is due to a desynchronization between the validation and routing of requests, allowing the bypassing of batch processing restrictions (allow_batch) and skipping input validation mechanisms. Its exploitation, combined with an SQL injection vulnerability, could allow for remote code execution (RCE) on the server.
On the other hand, the vulnerability CVE-2026-60137 is caused by insufficient sanitization of the author__not_in parameter and inadequate preparation of SQL queries. This enables an unauthenticated remote attacker to perform SQL injection to modify existing queries and access sensitive information stored in the database.
Affected Versions and Available Updates
These WordPress Core vulnerabilities affect the following core versions:
- WordPress Core 6.8 prior to version 6.8.6
- WordPress Core 6.9 prior to version 6.9.5
- WordPress Core 7.0 prior to version 7.0.2
WordPress has released patched versions for these branches. It is recommended to update to version 6.8.6, 6.9.5, or 7.0.2, or any later version that includes these fixes.
Severity and Impact of the Vulnerabilities
The vulnerability CVE-2026-63030 has a critical severity due to the possibility of remote code execution, affecting the confidentiality, integrity, and availability of the system. The vulnerability CVE-2026-60137 has a high severity and allows unauthorized information gathering through SQL injection.
Official Information and Follow-Up
Information about these vulnerabilities has been published by WordPress and compiled by INCIBE-CERT in its security notice. This notice details the technical characteristics, affected versions, and available patched versions.
Additional Technical Details on WordPress Core Vulnerabilities
The vulnerability CVE-2026-63030 focuses on a flaw in handling the /wp-json/batch/v1 endpoint of the REST API, where a desynchronization between validation and request routing allows a remote attacker to evade the established restrictions for batch processing (allow_batch). This situation facilitates the bypassing of input validation checks, which, combined with an SQL injection, can lead to remote code execution (RCE) on the affected server.
Meanwhile, the vulnerability CVE-2026-60137 originates from insufficient sanitization of the author__not_in parameter and incorrect preparation of SQL queries. This allows an unauthenticated remote attacker to perform SQL injections to modify existing queries and access sensitive information stored in the database, compromising data confidentiality.
Affected Versions and Published Solutions
The WordPress Core vulnerabilities affect versions prior to 6.8.6, 6.9.5, and 7.0.2, respectively, in the 6.8.x, 6.9.x, and 7.0.x branches. WordPress has released patched versions for these branches to mitigate the risks associated with these security flaws.
It is recommended to update to versions 6.8.6, 6.9.5, or 7.0.2, or any later version that includes these fixes, to reduce exposure to potential attacks that exploit these vulnerabilities.
Source: INCIBE-CERT - Multiple Vulnerabilities in WordPress Core
Published: 04/08/2026. Content reviewed using experience, authority and trustworthiness criteria (E-E-A-T).
This article may have used artificial intelligence tools to support structure, editing, translation or review. Editorial responsibility and final review remain with Toni Berraquero. View AI policy
You can support the project or share this article in one click. At least this block does something useful.