Multiple security vulnerabilities have been identified in WordPress, with affected releases including 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. The flaws can allow an unauthenticated attacker to reach functionality that should require authentication and then manipulate a database query. This combination may enable creation of an administrator account and installation of a malicious plugin that provides server-side code execution.
CVE-2026-63030: This flaw affects the REST API batch processing component, where nested requests can confuse route handling and reach functionality that should require authentication. An unauthenticated attacker can use crafted batch requests to create a path toward the second weakness, although the flaw alone does not execute code.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in WordPress, with affected releases including 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1. The flaws can allow an unauthenticated attacker to reach functionality that should require authentication and then manipulate a database query. This combination may enable creation of an administrator account and installation of a malicious plugin that provides server-side code execution.
CVE-2026-63030: This flaw affects the REST API batch processing component, where nested requests can confuse route handling and reach functionality that should require authentication. An unauthenticated attacker can use crafted batch requests to create a path toward the second weakness, although the flaw alone does not execute code.[emaillocker id="1283"]
CVE-2026-60137: This is an SQL injection flaw in the posts endpoint, where a public query parameter can be mishandled and alter the database query. When combined with the batch-processing flaw, an unauthenticated attacker can reach the vulnerable query and establish an administrator-level foothold that can lead to remote code execution.
These vulnerabilities collectively present a serious risk to public WordPress sites because an unauthenticated attacker can move from a normal request to administrator creation and server-side code execution. Sites running affected versions are most at risk, especially those exposed to the internet. The general action is to treat affected deployments as potentially compromised and prioritize investigation.
We recommend you to update WordPress to version 6.8.6, 6.9.5, or 7.0.2 depending on your installed branch.
The following reports contain further technical details:
[/emaillocker]