WordPress REST batch-route confusion can lead to remote code execution
A route-confusion weakness in the WordPress REST batch endpoint can be combined with the author__not_in SQL injection tracked as CVE-2026-60137. On affected WordPress 6.9 and 7.0 releases, an unauthenticated request can turn that chain into database compromise and potentially remote code execution.
- Component
- WordPress
- Plugin slug
Core- Affected
- 6.9.0 to < 6.9.5, 7.0.0 to < 7.0.2
- Safe version
6.9.5, 7.0.2- Published
- Jul 17, 2026
This CVE was published Jul 17, 2026 and is one of 45 known issues for WordPress core.
Patch or disable the affected component.
Update WordPress 6.9.x to 6.9.5 or later, or 7.0.x to 7.0.2 or later. WordPress.org enabled forced automatic updates for the affected release lines.
Technical description
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H