WordPress 6.8+ builds the post_author NOT IN (…) clause in WP_Query from author__not_in but only sanitises the value when it is already an array u2014 a scalar (reachable via the REST author_exclude parameter) skips absint() and is injected straight into the SQL. From 6.9+ this chains with the REST batch-route confusion (CVE-2026-63030) for pre-auth Remote Code Execution.
This vulnerability affects the following application versions:
- WordPress 6.8
- WordPress 6.8.1
- WordPress 6.8.2
- WordPress 6.8.3
- WordPress 6.8.4
- WordPress 6.8.5
- WordPress 6.9
- WordPress 6.9.1
- WordPress 6.9.2
- WordPress 6.9.3
- WordPress 6.9.4
- WordPress 7.0
- WordPress 7.0.1