CVE-2026-60137

exploited

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

open on the board →primary source ↗

signal timeline

CVE-2026-60137 — WordPress Core SQL Injection Vulnerability
CISA KEV · 29d ago

connections

CISA · co-mentioned

first seen 28d ago · last seen 4m ago

intelyard daily

One short email each weekday: what mattered in tech, written from source data and checked by a human. No account needed, one-click unsubscribe, and we never sell or share the address.