InfoSecBulletin Cybersecurity for mankind
The WordPress security team received reports about these flaws:
CVE-2026-60137 : A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
CVE-2026-63030 : A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber
Which versions of WordPress are vulnerable?
WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released containing fixes for both.
WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released containing a fix.
The beta release of WordPress 7.1 is affected by both vulnerabilities. Version 7.1 beta2 has been released containing fixes for both.
Versions of WordPress prior to 6.8 are not affected.
Emergency temporary mitigation
If you can’t do that, Security Researchers at Searchlight Cyber suggest you can temporarily protect your instance by blocking anonymous access to the batch API by:
Installing a plugin that blocks anonymous access to the rest API entirely; or
Blocking /wp-json/batch/v1 and ?rest_route=/batch/v1 at a WAF level.
Note that both these solutions may have impact on legitimate use of the site and should only be considered emergency temporary measures until you can update.
