WordPress has released emergency security updates to address two high-severity vulnerabilities, including a critical SQL injection flaw that could lead to remote code execution. Users are urged to patch their installations immediately.
The vulnerabilities were addressed in WordPress 6.9.5, 6.8.6, and 7.1 beta2, released on July 18, 2026.
The most severe of the two, identified as CVE-2026-63030, is a REST API batch-route confusion and SQL injection issue that could enable remote code execution. This vulnerability was reported by Adam Kues of Assetnote and Searchlight Cyber.
The second vulnerability, CVE-2026-60137, is a facilitated SQL injection issue. This flaw was reported collaboratively by TF1T, dtro, and haongo.
WordPress version 6.9 is affected by both CVE-2026-60137 and CVE-2026-63030, with fixes available in version 6.9.5. WordPress 6.8 is only vulnerable to CVE-2026-60137, and users should update to version 6.8.6. The beta release of WordPress 7.1 is also affected by both issues, with fixes included in 7.1 beta2.
WordPress versions prior to 6.8 are not affected by either vulnerability.
For instances where immediate patching is not feasible, security researchers at Searchlight Cyber have suggested temporary mitigation strategies. These include blocking anonymous access to the batch API. This can be achieved by installing a plugin that restricts anonymous access to the entire REST API, or by blocking requests to `/wp-json/batch/v1` and `?rest_route=/batch/v1` at a Web Application Firewall (WAF) level.
However, these temporary measures may disrupt legitimate site functionality and should only be considered as short-term solutions until the official updates can be applied.
