The WordPress Security Team has released core updates that patch a vulnerability chain capable of escalating from unauthenticated SQL injection to unauthenticated remote code execution. The fixes, issued on July 17, 2026, apply to WordPress core versions in the 6.8.x, 6.9.x, and 7.0.x lines, and site owners are being urged to verify that updates have installed successfully.
What WordPress patched
According to the advisory, WordPress core was updated to address two security issues. The first is an unauthenticated SQL injection vulnerability tracked as CVE-2026-60137. The second, CVE-2026-63030, can be chained with the SQL injection to raise the impact to unauthenticated remote code execution.
The WordPress Security Team said it has begun automatic updates for sites running vulnerable versions. At the same time, it is withholding additional technical details for now to reduce the risk to sites that have not yet been updated.
Versions that need attention
Users running WordPress core in the affected release branches should confirm they are on a patched build as soon as possible. The security team identified the following fixed versions:
- WordPress 6.8.x: 6.8.6
- WordPress 6.9.x: 6.9.5
- WordPress 7.0.x: 7.0.2
Those versions are the recommended endpoints for anyone currently on 6.8.X, 6.9.X, or 7.0.X. If a site is still on an earlier build within those branches, it should be treated as exposed until the update is confirmed.
The two vulnerabilities behind the chain
CVE-2026-60137: unauthenticated SQL injection
The first flaw affects the author__not_in parameter in WordPress core versions 6.8 through 7.0.1. Wordfence Intelligence describes it as a generic SQL injection issue caused by insufficient escaping of user-supplied input and inadequate preparation of an existing SQL query.
In practical terms, that means an unauthenticated attacker could append additional SQL queries to existing database calls. Wordfence’s summary says the issue could be used to extract sensitive information from the database.
CVE-2026-63030: remote code execution via REST API batch requests
The second flaw, rated critical with a CVSS score of 9.8, affects WordPress core 6.9 through 7.0.1. Wordfence Intelligence says it involves the REST API batch request endpoint at /wp-json/batch/v1 and stems from a route and validation desynchronization.
That desynchronization can allow a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction. With attacker-controlled parameters and bypassed input sanitization, the weakness can be chained with SQL injection and may allow code execution on the server.
Why the chain matters
Either issue is serious on its own, but the chaining aspect is what makes this case especially urgent. The SQL injection provides an entry point, while the REST API issue can be used to push the attack further toward server compromise.
Wordfence’s advisory frames the combination as an unauthenticated remote code execution vulnerability chain, which is the kind of flaw that can move quickly from disclosure to active exploitation if sites remain unpatched.
Protection is already rolling out
Wordfence said Premium, Care, and Response customers received a firewall rule protecting against attacks targeting the remote code execution vulnerability on July 17, 2026. Wordfence Free users are scheduled to receive the same protection 30 days later, on August 16, 2026.
That protection can help reduce exposure, but it is not a substitute for applying the WordPress core update. Security teams typically treat patching as the primary defense, with firewall coverage acting as an additional layer.
What site owners should do now
If you manage a WordPress site, the immediate step is to check the installed core version and confirm that the update completed successfully. Automatic updates have been initiated for vulnerable sites, but administrators should not assume the patch applied without verification.
A quick review of WordPress admin dashboards, update logs, hosting panels, or deployment pipelines can help confirm the site is running one of the fixed versions. In environments with multiple installations, each site should be checked separately.
- Confirm WordPress core is updated to 6.8.6, 6.9.5, or 7.0.2
- Review whether automatic updates completed successfully
- Check for unusual database activity or unexpected site behavior
- Ensure security tooling and firewall rules are current
Researchers and severity
Wordfence Intelligence lists Tin Pham, TF1T, Trong Pham, dtro, and haongo as researchers associated with the SQL injection issue. For the REST API batch request vulnerability, Wordfence credits Adam Kues.
The SQL injection flaw is rated CVSS 7.5, while the route confusion issue is rated CVSS 9.8. Together, the findings explain why the update has been treated as an urgent security release for WordPress core users.
With public details intentionally limited for now, the safest assumption is that any unpatched WordPress core installation in the affected branches should be considered at risk until proven otherwise.
Explore more: Blog Our Services Contact Us
Source: Original report
Was this helpful?
Last Modified: August 10, 2026 at 4:51 pm
2 views
