Known Exploited Vulnerabilities July 21, 2026 · CISA KEV Catalog

CVE-2026-60137: Word Press Core SQL Injection Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Read the original at CISA KEV Catalog ↗

Topics

Vulnerabilities & Patching

Mentions

CVE-2026-60137WordPress

Related

CVE-2026-119977: Word Press Word Press Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability Known Exploited Vulnerabilities · Nov 03, 2026

CVE-2026-87902: Word Press Core Remote File Inclusion Vulnerability Known Exploited Vulnerabilities · Sep 25, 2026

CVE-2026-63030: Word Press Core Interpretation Conflict Vulnerability Known Exploited Vulnerabilities · Jul 21, 2026