## Summary
WordPress versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 are affected by a REST API batch-route confusion weakness. When combined with an author__not_in WP_Query SQL injection issue (CVE-2026-60137 / GHSA-fpp7-x2x2-2mjf), it can enable SQL Injection and Remote Code Execution (RCE).
## Technical Details
- The issue is described as a “REST API batch-route confusion” in WordPress 6.9 and higher.
- The weakness is combined with a separate SQL injection vulnerability involving author__not_in in WP_Query.
- The combined exploitation path can result in Remote Code Execution (CWE-436: “Interpretation Conflict”).
- WordPress security advisories note that fixes were included in specific releases and that the vulnerability is severe enough to warrant immediate updates.
## Affected
- WordPress 6.9.x before 6.9.5
- WordPress 7.0.x before 7.0.2
- (Also mentioned in release notes) WordPress 6.8 is affected by the first vulnerability; fixed in 6.8.6
- (Also mentioned in release notes) WordPress 7.1 beta2 is affected; fixed in 7.1 beta2
## Impact
- Attack vector is NETWORK with no required privileges (PR:N) and no user interaction (UI:N).
- Successful exploitation can lead to SQL Injection and Remote Code Execution.
## Mitigation
1. Update WordPress immediately to a fixed version: 6.9.5 or 7.0.2 (or later).
2. If running 6.8, update to 6.8.6.
3. For sites on affected versions, rely on WordPress.org’s forced auto-update mechanism where enabled, or update manually via the WordPress Dashboard (Updates → Update Now).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-436