CISA Warns WordPress Core SQL Injection Vulnerability Is Actively Exploited in Attacks

Gbhackers •Divya • July 22, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has classified a critical SQL injection vulnerability in WordPress Core, tracked as CVE-2026-60137, as one of its Known Exploited Vulnerabilities (KEV) due to its active exploitation in real-world attacks. This vulnerability affects the core functionality of WordPress when themes or plugins fail to properly validate untrusted input […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CISA Alerts on Actively Exploited SQL Injection Vulnerabilities in WordPress CISA has identified two critical SQL injection vulnerabilities in WordPress Core, CVE-2026-60137 and CVE-2026-63030, as actively exploited in the wild. Both vulnerabilities were published on July 17, 2026, and added to CISA's Known Exploited Vulnerabilities catalog on July 21, 2026. These flaws allow attackers to compromise websites and potentially execute remote code. The vulnerabilities arise from inadequate validation of untrusted input in WordPress themes and plugins. The first public proof of concept (PoC) for CVE-2026-60137 was released on July 19, while CVE-2026-63030 had its PoC available a day earlier on July 18. Website administrators are urged to apply patches immediately to mitigate risks. 2 sources 73

Extracted Entities

CISA Warns WordPress Core SQL Injection Vulnerability Is Actively Exploited in Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)