Is CVE-2026-60137 in the CISA Known Exploited Vulnerabilities catalog?

Yes — CVE-2026-60137 is listed in CISA KEV, remediation due 2026-08-04.

Which frameworks does CVE-2026-60137 affect?

CVE-2026-60137 affects WordPress.

CISA Known Exploited Vulnerability

CVE-2026-60137

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated

⚠ Actively exploited (CISA KEV) WordPress 2026

CISA catalog entry

Product

Core

Vendor

WordPress

Added to KEV

2026-07-21

Remediation due

2026-08-04

What WebPulse reported · 1 analysis

A WordPress RCE That Skips the Plugin Layer Entirely

Two chained CVEs enable pre-authenticated code execution on standard WordPress installs. Patches shipped July 17 — sites that haven't applied them are exposed.

July 22, 2026

View CVE-2026-60137 on the NIST National Vulnerability Database →

Related vulnerabilities

CVE-2026-8732 CVE-2026-8206 CVE-2026-8181 CVE-2026-63030 CVE-2026-41940 CVE-2026-4020 CVE-2026-3844 CVE-2026-3300