Critical & High Severity WordPress SQL Injection Vulnerabilities (CVE‑2026‑60137, CVE‑2026‑63030) Threaten Sites Running 6.9 and 7.1 Beta
What It Is – Two newly disclosed WordPress flaws affect the core 6.9 release and the 7.1 beta. CVE‑2026‑60137 is a facilitated SQL‑injection; CVE‑2026‑63030 is a REST‑API batch‑route confusion that can be chained to remote code execution.
Exploitability – Both have public proofs of concept. CVE‑2026‑63030 can be leveraged to achieve RCE without authentication. CVSS scores: CVE‑2026‑60137 = 9.8 (Critical), CVE‑2026‑63030 = 9.3 (High).
Affected Products – WordPress 6.9 (both CVEs), WordPress 6.8 (CVE‑2026‑60137 only). Patches are in 6.9.5, 6.8.6, and 7.1 beta2.
Why It Matters for Compliance & Audit Readiness
- Control Mapping – The flaws expose gaps in “Secure Development” and “Change Management” controls (SOC 2 CC6.1, CC6.2). Mapping them to your control framework demonstrates due diligence.
- Continuous Evidence – Patch deployment and WAF rule changes can be logged automatically, providing immutable audit evidence for SOC 2 examinations.
- Enterprise Buyer Expectations – Many SaaS buyers now require proof that critical platform components are patched within vendor‑defined SLAs; a documented remediation workflow satisfies that demand.
Recommended Actions
- Upgrade WordPress to 6.9.5 (or 6.8.6 / 7.1 beta2 as appropriate) immediately.
- If patching is delayed, block anonymous access to
/wp-json/batch/v1via a WAF or a “disable REST API for unauthenticated users” plugin. - Record the patch rollout in your change‑management system and capture WAF rule logs as SOC 2 evidence.
- Map the vulnerabilities to the relevant SOC 2 control set (Secure Development, Change Management) in your compliance platform.
Source: Help Net Security – WordPress vulnerabilities (CVE‑2026‑60137, CVE‑2026‑63030)