Injection: WordPress Core - Pre-Authentication Blind SQL Injection¶

Identifier: cve_2026_63030

Scanner(s) Support¶

GraphQL Scanner	REST Scanner	WebApp Scanner	ASM Scanner

Description¶

WordPress core 6.9.0-6.9.4 and 7.0.0-7.0.1 contain a pre-authentication time-based blind SQL injection reachable through the REST API batch endpoint, where a route-confusion authentication bypass is chained with a SQL injection in the author_exclude parameter of /wp/v2/categories to extract the full database including user credentials.

How we test: We send a nested batch request to /?rest_route=/batch/v1 carrying a SLEEP-based timing payload in the author_exclude parameter, then compare the response time between a false condition (no delay) and a true condition (delayed), confirming blind SQL injection when only the true condition delays the response.

Reference:

Configuration¶

Example¶

Example configuration:

---
security_tests:
  cve_2026_63030:
    skip: false

Reference¶

`skip`¶

Type : boolean

Skip the test if true.