CVE record · 6 sources
CVE-2026-60137
KEVCVSS 9.1WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter.
- Vendor
- Fortinet, Elastic
- Product
- WordPress core
- CVSS
- 9.1
- EPSS
- 1.00 (p100)
- CISA KEV
- listed
- Exposure class
- Web platform, AI infrastructure, Database
Coverage
7Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.
-
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter.
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code…
-
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2021-27137 DD-WRT Stack-Based Buffer Overflow Vulnerability CVE-2026-0770 Langflow…
-
Exploitation in the Wild of wp2shell
Wiz Research has identified exploitation of "wp2shell", a critical pre-auth RCE vulnerability chain impacting WordPress Core (CVE-2026-63030 & CVE-2026-60137). Attackers are deploying persistent webshells on vulnerable servers.…
-
September 2026 CVE Landscape
In September 2026, Insikt Group® identified 94 high-impact vulnerabilities that should be prioritized for remediation, 59 of which had a Very Critical Recorded Future Risk Score. This represents a 29% increase from last month.
-
WP2Shell RCE
FortiGuard Labs continues to detect exploitation attempts targeting the WP2Shell attack chain (CVE-2026-63030 and CVE-2026-60137), a critical unauthenticated remote code execution (RCE) vulnerability affecting WordPress Core.…
-
wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution
We ran the wp2shell WordPress RCE chain end-to-end with Elastic Defend. Detection rule walkthrough, IOCs, and hunt guidance.
-
July 2026 CVE Landscape
In July 2026, Insikt Group® identified 85 high-impact vulnerabilities that should be prioritized for remediation, 36 of which had a Very Critical Recorded Future Risk Score. This represents a 44% increase from last month.