WordPress 7.0.2 Emergency Patch Closes Unauthenticated SQL Injection Vulnerability

WordPress released an emergency security update, version 7.0.2, on July 17, 2026, to fix a critical vulnerability that allowed unauthenticated attackers to perform SQL injection attacks on websites running versions 6.8 through 7.0.1. SQL injection is a type of attack where an attacker inserts malicious code into a website's database commands to steal or change data. The flaw, rated critical because it required no login and could be mass exploited, was actually a chain of two separate vulnerabilities that together enabled full site takeover, including remote code execution, where an attacker can run their own programs on the server. Security researchers at Patchstack, who discovered and reported the issues, confirmed active exploitation attempts in the wild immediately after the disclosure.

The first vulnerability (CVE-2026-60137) resided in the WordPress core function WP_Query, which builds the exact questions asked to the database when constructing a page. Specifically, the author__not_in query variable failed to properly sanitize input when it was supplied as a string rather than as an array (a programming term for a list of values). Normally, this value is validated as a list of numbers and would never reach the database in a dangerous form. However, due to a missing check, a string could slip through, allowing an attacker to inject malicious SQL commands. The fix replaced the flawed sanitization with a function that converts any input into a clean list of numbers, closing the injection point.

But this first flaw alone was not remotely exploitable under normal WordPress REST API handling, because the API's filters would have rejected a non-array value. The REST API is a set of web addresses that external applications use to communicate with a WordPress site, such as to create posts or retrieve content. That is where the second, critical vulnerability (CVE-2026-63030) came into play. Introduced in WordPress 6.9, a route confusion bug in the REST API batch endpoint could be exploited to defeat input validation. The batch endpoint is a special address that bundles multiple data requests into one call, meant to save time but here exploited to confuse validation. By sending a carefully crafted first request that caused a parsing error, an attacker could desynchronize the internal lists that track which handler validates a request and which handler actually executes it. This shift meant that a malicious GET request with a poisoned author_exclude parameter would be validated by a handler that does not enforce the list-of-numbers rule, but then executed by a different handler that passes the unchecked value straight into WP_Query, triggering the SQL injection.

Because no authentication was required and the attack could be automated, the WordPress core team treated this as the highest priority. They force-pushed the update to many sites, ensuring automatic installation. Site owners should verify they are running version 7.0.2, or the backported fixes: 6.9.5 (which fixes both issues) and 6.8.6 (which only patches the SQL injection, as the route confusion was not present). For those unable to update immediately, enabling a web application firewall or virtual patching rules can block the attack. Patchstack deployed protection rules within hours and saw exploitation attempts spike.

The implications for website owners are severe: successful exploitation could leak sensitive data, deface sites, or install backdoors for persistent access. The fact that attackers were observed weaponizing the flaw within ninety minutes of disclosure underscores the urgency of patching. For site owners who rely on managed WordPress hosting, like AEU Hosting, automatic updates and built-in security layers can provide rapid protection without manual intervention. Regardless of the hosting environment, the most crucial step is to update immediately and audit user accounts for any unauthorized additions. Backup your site files and database regularly, and monitor your logs for unusual REST API activity. If you cannot patch right away, consider temporarily disabling the REST API or restricting access to it until you can apply the update.