CVE-2026-60137: WordPress Core SQL Injection Vulnerability
What it is
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
What to do
Fix within your normal patch cycle and well before the CISA date. Check that your scanning covers this product so nothing is missed.
- Priority
- Plan: Fix within your normal patch cycle, before the CISA date.
- Severity (CVSS)
- 5.9 medium
- CISA assessment (SSVC)
- actively exploited; needs manual effort per target; total control of the affected system
- Exploit probability (EPSS, 30 days)
- 5.3%, higher than 92% of all CVEs
- Added to CISA KEV
- 21 July 2026
- CISA fix-by date
- 4 August 2026 (US federal agencies; a sensible deadline for everyone)
- Ransomware use
- Not known
- Weakness
- CWE-89
References
- NIST NVD entry
- CISA KEV entry
- github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
- wordpress.org/news/2026/07/wordpress-7-0-2-release/
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
Sources: CISA Known Exploited Vulnerabilities · FIRST Exploit Prediction Scoring System (EPSS) · NIST National Vulnerability Database · CISA Vulnrichment (SSVC), via the CVE Program. This product uses data from the NVD API but is not endorsed or certified by the NVD. Summaries are machine-written from CISA’s description; treat the vendor’s advisory as the authority for fixes.