Vulnerabilities

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter.

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Read at NIST National Vulnerability Database (CVE API 2.0)

Product

WordPress core

CVSS

9.1

CISA KEV

listed

Exploitation

observed in the wild

Fix

available

Exposure class

Web platform

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-60137 on this site · NVD · CVE.org · Vulnpedia · KEV

Other items that share a CVE or were clustered with this one.

1. 31
   Research Insikt Group 19d ago

   September 2026 CVE Landscape

   EPSS 1.00 CVE-2026-88771CVE-2026-88772CVE-2026-35273+57 more
2. 16
   Research Insikt Group 7 Aug 2026

   July 2026 CVE Landscape

   CVE-2025-3248CVE-2008-4128CVE-2017-17215+57 more
3. 25
   Outbreak alert FortiGuard 31 Jul 2026

   WP2Shell RCE

   CVE-2026-63030CVE-2026-60137 Fortinet
4. 21
   Research Elastic Security Labs 23 Jul 2026

   wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

   CVE-2026-63030CVE-2026-60137 Elastic
5. 46
   CISA advisory CISA 21 Jul 2026

   CISA Adds Four Known Exploited Vulnerabilities to Catalog

   Exploited CVE-2021-27137CVE-2026-0770CVE-2026-63030+1 more
6. 44
   Wiz Research Wiz 20 Jul 2026

   Exploitation in the Wild of wp2shell

   Exploited CVE-2026-63030CVE-2026-60137