WordPress 7.0.2 Fixes Critical Unauthenticated SQL Injection

WordPress 7.0.2 fixes a critical unauthenticated SQL injection vulnerability that, when combined with a REST API route confusion flaw, could let attackers fully take over a website, according to security firm Patchstack. The release, shipped on 17 July 2026, addresses two separate issues that together create a remote code execution chain. Patchstack separately verified that the combined vulnerabilities can lead to full site takeovers and is already seeing active exploitation attempts in its logs.

The two vulnerabilities are tracked as CVE-2026-60137 for the SQL injection in WP_Query and CVE-2026-63030 for the REST API batch route/handler confusion. The first issue affects WordPress versions 6.8 through 7.0.1, while the second was introduced in 6.9 and also affects up to 7.0.1. The WordPress core team released fixes in three branches: WordPress 7.0.2 fixes both, 6.9.5 is a backport of both to the 6.9 branch, and 6.8.6 is unaffected by the route confusion but includes the SQL injection patch. Because the vulnerability is unauthenticated and mass-exploitable, WordPress pushed a forced update to impacted sites, though site owners should still confirm they are on a patched version.

The SQL injection flaw, reported by researchers TF1T, dtro, and haongo, sits in how WP_Query, the WordPress class that builds database queries, handles the author__not_in query variable. In affected versions, the code only sanitized the input when it arrived as an array. If an attacker can make the value arrive as a string, the integer sanitization is skipped entirely. The raw string is then cast to an array, joined, and placed directly into the SQL WHERE clause without proper escaping or parameterization. By itself, this is not normally reachable because the REST API validates the author_exclude parameter as an array of integers. But the second vulnerability changes that processing path.

The critical REST API flaw, reported by Adam Kues of Assetnote / Searchlight Cyber, affects the batch endpoint in WP_REST_Server::server_batch_request_v1(). That endpoint lets a client bundle multiple sub-requests into one call. The handler builds two arrays: one for all requests and one for matched handlers. An index desynchronization appears because error entries are not added to the matches array. An attacker can first send a sub-request with the path http://, which fails URL parsing and creates an error at index 0 without a corresponding match. After that, every later handler lookup is shifted by one. By nesting a second batch, the attacker lands a request such as GET /wp/v2/posts?author_exclude= so that it is validated against a different handler, the POST create posts handler, where author_exclude is not a registered collection filter and its normal array-of-integers validation never runs. Then it is executed against the shifted match for the GET collection route, calling the unauthenticated get_items() function with an unvalidated author_exclude. The fix in 7.0.2 keeps the arrays index-aligned by also pushing errors into the matches array and adds a re-entrancy guard to prevent a fresh top-level REST cycle from starting while a dispatch is in flight.

The combined chain is serious: an unauthenticated attacker can reach the SQL injection without any account, and Patchstack says the chain can lead to full site takeover, including remote code execution, which means the attacker can run their own code on the server. Patchstack deployed its RapidMitigate virtual patching rules immediately and has seen exploitation attempts in its logs. Because of the active exploitation and the unauthenticated nature, the WordPress core team treated this as the highest priority issue and pushed a forced update to impacted sites. For readers who manage their own websites, the immediate step is to verify that the site runs WordPress 7.0.2, or 6.9.5, or 6.8.6, depending on the branch. It is also wise to review user accounts for any unrecognized administrator or editor accounts, as attackers who exploit this may create or elevate users. Managed WordPress hosting services such as AEU Hosting are built to keep WordPress installations secured, which may include automated updates and server-level protections, but site owners should still confirm their version as recommended.