wordpress 7.0.2 closes an exploited core sql injection to rce chain

what happened

• WordPress 7.0.2, released July 17, 2026, fixed CVE-2026-63030, a REST API batch-route confusion flaw reported by Adam Kues of Assetnote / Searchlight Cyber, and CVE-2026-60137, an SQL injection in the author__not_in parameter of WP_Query.[1,2,3]
• NVD lists WPScan scores of 9.8 (CVSS v3.1) for CVE-2026-63030 and 5.9 (CVSS v3.1) for CVE-2026-60137.[2,3]
• The batch-route flaw affects WordPress 6.9 before 6.9.5 and 7.0 before 7.0.2. The SQL injection also affects 6.8 before 6.8.6, and versions before 6.8 are not affected.[1,2,3]
• CISA added both CVEs to its Known Exploited Vulnerabilities catalog on 2026-07-21, noting that chained together they allow an unauthenticated attacker to gain remote code execution on default WordPress installations.[4]
• New Zealand's NCSC warned on July 20, 2026 that the two vulnerabilities were under active exploitation.[5]
• WordPress.org enabled forced updates through the auto-update system for sites running affected versions.[1]
• Qualys, which calls the chain wp2shell, reported public exploits that use the SQL injection to extract password hashes, crack an administrator password, upload a malicious plugin and run commands.[6]