Critical RCE and SQLi Vulnerabilities Patched in WordPress 7.0.2

Overview

WordPress has released version 7.0.2, a critical security update that addresses two high-severity vulnerabilities: a facilitated SQL injection (CVE-2026-60137) and a REST API batch-route confusion issue leading to Remote Code Execution (RCE) (CVE-2026-63030). These vulnerabilities pose significant risks to WordPress installations, potentially allowing attackers to gain control over affected websites or extract sensitive data. The update was released on July 18, 2026, and users are urged to patch their installations immediately to protect against potential exploitation. The flaws were reported by security researchers, with the RCE vulnerability attributed to Adam Kues at Assetnote / Searchlight Cyber.

Technical Details

CVE-2026-60137: Facilitated SQL Injection This vulnerability allows for a facilitated SQL injection. While specific technical details on how it is “facilitated” are not fully public, SQL injection flaws typically allow an attacker to inject malicious SQL code into input fields, which is then executed by the database. This can lead to unauthorized access to, modification of, or deletion of database contents, including user credentials, sensitive post data, or configuration settings. A “facilitated” aspect might imply specific conditions or a particular vector that makes the exploitation easier or more potent than a standard SQL injection.

CVE-2026-63030: REST API Batch-Route Confusion and SQL Injection leading to Remote Code Execution This flaw is particularly critical as it combines a REST API batch-route confusion with SQL injection, ultimately leading to Remote Code Execution (RCE).

• REST API Batch-Route Confusion: The WordPress REST API allows for batch processing of requests, which can sometimes be exploited if not properly secured. “Route confusion” suggests that an attacker might be able to manipulate how the API processes multiple requests or interprets routing paths, possibly bypassing authentication or authorization checks.
• SQL Injection: Within this confused state, an attacker can then leverage SQL injection techniques.
• Remote Code Execution: The combination of these two factors allows an attacker to execute arbitrary code on the server hosting the WordPress installation. RCE is one of the most severe types of vulnerabilities, granting attackers full control over the compromised system, enabling them to install backdoors, deface websites, steal data, or pivot to other systems within the network. This vulnerability can be particularly dangerous as it is a pre-authentication RCE, meaning no prior credentials are required for exploitation.

Real-World Impact

The real-world impact of these vulnerabilities, especially CVE-2026-63030, is severe. With millions of websites powered by WordPress, the potential for widespread exploitation is substantial. An attacker successfully exploiting the RCE vulnerability could completely compromise a website, leading to:

• Data Theft: Exfiltration of sensitive user data, intellectual property, or business records from the database.
• Website Defacement: Malicious modification of website content, leading to reputational damage.
• Malware Distribution: Hosting and distributing malware to visitors of the compromised site.
• SEO Spam: Injection of spam content and links, negatively affecting search engine rankings.
• Further Network Compromise: Using the compromised WordPress server as a pivot point to attack other systems within the hosting environment or connected networks. The facilitated SQL injection (CVE-2026-60137) could also lead to significant data breaches or integrity issues, depending on the specific data stored and accessed. Given the widespread use of WordPress, these vulnerabilities represent a critical threat to individuals, small businesses, and large enterprises alike.

Threat Landscape

WordPress continues to be the most popular Content Management System (CMS) globally, making it a prime target for cybercriminals. The discovery of critical vulnerabilities like RCE and SQL injection is a recurring theme in its threat landscape. Threat actors actively scan for unpatched WordPress sites, and public disclosure of vulnerabilities often quickly leads to exploit development and widespread attacks. Organizations like Assetnote / Searchlight Cyber, who reported the RCE, play a crucial role in identifying and responsibly disclosing such flaws. The rapid patching by the WordPress security team demonstrates the community’s commitment to security, but also highlights the constant race between defenders and attackers. The threat for these types of vulnerabilities remains high, especially for installations that are not updated promptly.

Remediation

Immediate remediation is crucial for all WordPress users.

1. Update Immediately: All WordPress installations should be updated to version 7.0.2 as soon as possible. This is the most effective way to address both CVE-2026-60137 and CVE-2026-63030.
2. Backup: Before applying any updates, ensure a full backup of your website’s files and database is performed.
3. Monitor for Suspicious Activity: After updating, monitor your website and server logs for any signs of compromise that might have occurred prior to patching or if the patch was not applied quickly enough. Look for unusual file modifications, unexpected user accounts, or outbound connections.
4. Review Access Controls: Ensure strong passwords and least privilege principles are applied to all WordPress user accounts and hosting environment access.
5. Web Application Firewall (WAF): Deploying a WAF can provide an additional layer of protection by helping to detect and block exploitation attempts, especially for sites that cannot be patched immediately.
6. Security Audits: Regularly conduct security audits and penetration tests on WordPress installations to identify and address potential weaknesses proactively.

---