BIT-wordpress-multisite-2026-63030
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/wordpress-multisite/BIT-wordpress-multisite-2026-63030.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-wordpress-multisite-2026-63030
- Aliases
-
- BIT-wordpress-2026-63030
- CVE-2026-63030
- Published
- 2026-07-27T05:55:58.991Z
- Modified
- 2026-07-27T09:11:43.524686700Z
- Summary
- WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- Details
-
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__notin WPQuery SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
- Database specific
{ "cpes": [ "cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*" ], "severity": "Critical" }- References
Affected packages
Bitnami / wordpress-multisite
Package
- Name
- wordpress-multisite
- Purl
- pkg:bitnami/wordpress-multisite
Severity
- 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator