Pre-auth SQL injection RCE disclosed in recent WordPress core versions

Hacktron says CVE-2026-63030 is a pre-authentication remote code execution vulnerability affecting WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1, crediting the discovery to security firm Assetnote. Independent technical writeups describe the chain in more detail: the WordPress REST API's batch-request endpoint keeps two internal lists in sync while validating sub-requests, and a malformed URL can desynchronize them, letting a request past a check it should have failed; that gap connects to a separate bug in how WordPress's query class handles one of its filter parameters, which fails to sanitize input when it receives a string instead of an expected array, opening a direct SQL injection path with no login required.

WordPress versions before 6.9.0 lack the batch endpoint entirely and are not exposed to this specific chain, matching what Hacktron's tweet states. The fix ships in WordPress 6.9.5 and 7.0.2, a targeted patch rather than a version-line replacement, so any site still running an affected version should update immediately rather than wait for a broader upgrade cycle.