CVE-2026-63030

Aliases:DEBIAN-CVE-2026-63030
Advisory lineage Upstream: 0 Downstream: 1
Analyzed
Published: 17 Jul 2026, 19:14
Last modified:22 Jul 2026, 03:55

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
95.6% CRITICAL
96% probability 0.00%
KEV
Listed
CISA
1 listing
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

17 Jul 2026, 19:14
Published
Vulnerability first disclosed
21 Jul 2026, 00:00
Added to CISA KEV
WordPress Core Interpretation Conflict Vulnerability
22 Jul 2026, 03:55
Last Modified
Vulnerability information updated
24 Jul 2026, 00:00
CISA Remediation Due
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 95.60%• Percentile: 100%

Techniques & Countermeasures

  • CWE-436•Interpretation Conflict

    Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.

Affected Systems

  • debian•wordpress

    < 7.0.2+dfsg1-1

  • wordpress•wordpress

    ≥ 6.9.0, < 6.9.5 | ≥ 7.0.0, < 7.0.2 | ≥ 6.9, < 6.9.5 | ≥ 7.0, < 7.0.2

References (4)