Summary
generated automatically from NVD dataWordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 contain a route confusion flaw in the REST API batch endpoint (CWE-436). When chained with the author__not_in WP_Query SQL injection tracked as CVE-2026-60137, it could allow an attacker to perform SQL injection and ultimately achieve remote code execution. It carries a CVSS v3.1 score of 9.8 (CRITICAL) and is listed in the CISA KEV catalog, indicating active exploitation.
NVD description
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
⚠️ Actively exploited — CISA KEV
This CVE was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21. It is confirmed exploited in the wild and must be patched as a priority.
Remediation deadline (US federal agencies): 2026-07-24
EPSS · FIRST.org
10.6%probability of exploitation in the next 30 days
Higher than 95% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-16, recomputed daily by FIRST.org.
In-depth analysis on cveo.tech
We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.
CVSS v3.1 Score
Information
- Published
- 17 juil. 2026
- Updated
- 8 oct. 2026
- Status
- Analyzed
- Source
- contact@wpscan.com
Affected products
Weaknesses (CWE)
References (3)
Similar CVEs
Other vulnerabilities of type CWE-436
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.