WordPress Security Updates – 19 July 2026

The addressed vulnerabilities could allow the attacker to perform SQL injection attacks, which may lead to remote code execution on the affected system.

The addressed vulnerabilities:

1. WordPress REST API Batch-Route Confusion Vulnerability (CVE-2026-63030):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Remote Code Execution

2. WordPress Facilitated SQL Injection Vulnerability (CVE-2026-60137)

• CVSS: 5.9
• Attack Vector: Network
• Attack Complexity: High
• Privileges Required: None
• User Interaction: None
• Consequences: Remote Code Execution

It should be highlighted that security researchers publicly disclosed a proof-ofconcept (PoC) for the vulnerabilities “CVE-2026-63030” and “CVE-2026-60137” that exist in the wild.