WordPress REST batch-route confusion can lead to remote code execution
A route-confusion weakness in the WordPress REST batch endpoint can be combined with the author__not_in SQL injection tracked as CVE-2026-60137. On affected WordPress 6.9 and 7.0 releases, an unauthenticated request can turn that chain into database compromise and potentially remote code execution.
- Component
- WordPress
- Plugin slug
Core- Affected
- 6.9.0 to < 6.9.5, 7.0.0 to < 7.0.2
- Safe version
6.9.5, 7.0.2- Published
- Jul 17, 2026
This CVE was published Jul 17, 2026 and is one of 47 known issues for WordPress core.
Update, patch or deactivate.
Update WordPress 6.9.x to 6.9.5 or later, or 7.0.x to 7.0.2 or later. WordPress.org enabled forced automatic updates for the affected release lines.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H