CVE-Katalog

CVE-2026-63030

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), coul

[CVE-Katalog]

Schweregrad: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Jul 17, 2026, 8:17:28 PM UTC
Source: [NVD] · [CVE record]
Exploitation: CISA Known Exploited Vulnerabilities
EPSS: 10.65% · Oct 22, 2026

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	wordpress	sid	`7.1.3+dfsg1-1`	fixed
Debian	wordpress	forky	`7.1.3+dfsg1-1`	fixed
Debian	wordpress	trixie	`6.8.7+dfsg1-0+deb13u1`	not affected
Debian	wordpress	trixie-security	`6.8.10+dfsg1-0+deb13u1`	not affected
Debian	wordpress	bookworm	`6.1.9+dfsg1-0+deb12u1`	not affected
Debian	wordpress	bookworm-security	`6.1.9+dfsg1-0+deb12u1`	not affected
Cpe	wordpress	Not reported	Not reported	vulnerable
Cpe	wordpress	Not reported	`7.0.2`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	wordpress	source	sid	`7.0.2+dfsg1-1`	not yet assigned	Not reported	[1142511]
Debian	wordpress	source	forky	`7.0.2+dfsg1-1`	not yet assigned	Not reported	[1142511]
Debian	wordpress	source	trixie	`Not affected`	unimportant	Not reported	[1142511]
Debian	wordpress	source	bookworm	`Not affected`	unimportant	Not reported	[1142511]
Cpe	wordpress	cpe	Not reported	`7.0.2`	Not reported	NVD-CVE-2026-63030	Not reported

[Debian bug #1142511]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[wordpress]Nicht betroffen
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
[wordpress-l10n]Nicht betroffen
Quellpaket: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
[wordpress-theme-twentytwentyone]Nicht betroffen
Quellpaket: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
[wordpress-theme-twentytwentythree]Nicht betroffen
Quellpaket: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
[wordpress-theme-twentytwentytwo]Nicht betroffen
Quellpaket: [wordpress]
Details (4)
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm
- 6.1.9+dfsg1-0+deb12u1 · all · bookworm-security
  Nicht betroffen
  nvd · wordpress · debian · bookworm

Beobachtet: Oct 24, 2026, 4:28:53 AM UTC

Referenzen

[CERT-Bund public advisories] · [CISA Known Exploited Vulnerabilities (OSINT)] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]