Skip to content
CISA Known Exploited Vulnerability

CVE-2026-60137 — WordPress Actively Exploited CVE

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated

⚠ Actively exploited (CISA KEV) WordPress 2026
CISA catalog entry
Product
Core
Vendor
WordPress
Added to KEV
2026-07-21
Remediation due
2026-08-04
What WebPulse reported · 4 analyses
Google Gives Threat Actors One Primary Name — and Keeps the Rest Searchable

A canonical-name-with-aliases system consolidates the post-Mandiant/TAG merger. WebPulse reads this as infrastructure for machine-speed triage.

July 27, 2026
Claude Opus 5 Ships Coding and Cybersecurity in One Model. Here's What That Means for Framework Choice.

When a single AI model writes production code and evaluates security posture in the same session, the framework underneath shapes the terrain it encounters.

July 27, 2026
Two WordPress Core Flaws Let Attackers Plant Plugins That Outlast Cleanup

CVE-2026-63030 and CVE-2026-60137 are being exploited to install persistent webshells through WordPress Core's plugin installer.

July 22, 2026
A WordPress RCE That Skips the Plugin Layer Entirely

Two chained CVEs enable pre-authenticated code execution on standard WordPress installs. Patches shipped July 17 — sites that haven't applied them are exposed.

July 22, 2026
View CVE-2026-60137 on the NIST National Vulnerability Database →
Related vulnerabilities
CVE-2026-63030 CVE-2026-8732 CVE-2026-8206 CVE-2026-8181 CVE-2026-41940 CVE-2026-3844 CVE-2026-3300 CVE-2025-4322