WordPress Core 6.9 - 7.0.1 - Remote Code Execution via REST API Batch Request Route Confusion
Strategic Overview
6.9 – < 7.0.2 · 2 branchesCVE-2026-63030Vulnerability Overview
WordPress Core is vulnerable to Remote Code Execution in all versions 6.9 to 7.0.1 via the REST API batch request endpoint (/wp-json/batch/v1). This is due to a route/validation desynchronization that allows a validated sub-request to be dispatched to an unintended callback, bypassing the allow_batch restriction, with attacker-controlled parameters and the target route's input sanitization bypassed, which can be chained with SQL Injection. This may make it possible for attackers to execute code on the server.
Technical Analysis
REMEDIATION: Update to one of the following versions, or a newer patched version: 6.9.5, 7.0.2 --- IDENTIFIER: CWE-670 (Always-Incorrect Control Flow Implementation) The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C