WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

Exploit for SQL Injection in Wordpress

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destruc...

Exploit for CVE-2026-63030

CVE-2026-63030 WordPress REST Batch Route-Confusion SQL I...