CVE-2026-60137 / CVE-2026-63030 | WordPress Core SQL Injection and Pre-Authentication Remote Code Execution Vulnerabilities

<p>WordPress Core contains two vulnerabilities that can be chained together to enable unauthenticated remote code execution on default WordPress installations. CVE-2026-60137 is a SQL injection vulnerability in that improperly sanitizes the parameter, while CVE-2026-63030 is a REST API batch endpoint route confusion vulnerability. Individually, CVE-2026-60137 has a CVSS score of 5.9 (Medium)…</p>