Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (CVE-2026-63030) - Vulnerability Database

REST API batch-route confusion and SQL injection issue leading to Remote Code Execution (CVE-2026-63030)

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

References

CVE-2026-63030

Related Vulnerabilities

Joomla Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2022-23794) Medium
Common tags: Missing Update Known Vulnerabilities
MySQL CVE-2020-2896 Vulnerability (CVE-2020-2896) Medium
Common tags: Missing Update Known Vulnerabilities
Oracle JRE CVE-2020-2816 Vulnerability (CVE-2020-2816) High
Common tags: Missing Update Known Vulnerabilities
WebLogic CVE-2020-2828 Vulnerability (CVE-2020-2828) High
Common tags: Missing Update Known Vulnerabilities
WebLogic CVE-2020-2829 Vulnerability (CVE-2020-2829) Medium
Common tags: Missing Update Known Vulnerabilities

Severity

Critical

Classification

CVE-2026-63030

Tags

Missing Update
Known Vulnerabilities