HIGHVulnerability
Verified
Global

CISA KEV: WordPress Core — WordPress Core SQL Injection Vulnerability

·Source: CISA KEV

Updated:

Executive Summary

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Analysis

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Added to CISA Known Exploited Vulnerabilities catalog on 2026-07-21. Remediation due: 2026-08-04.

Indicators of Compromise (2)

CVE (2)
CVE-2026-63030
NVDMITRE CVE
CVE-2026-60137
NVDMITRE CVE
Source Attribution

Originally published by CISA KEV on Jul 21, 2026. Verified by: CISA.

Related Threats

CRITICALVulnerability

Critical SharePoint RCE flaw exploited to steal machine keys

Hackers are actively exploiting the critical CVE-2026-50522 vulnerability in Microsoft SharePoint to steal machine keys and maintain access even after affected servers are patched. [...]

CVE-2026-50522
BleepingComputer
MEDIUMVulnerability

How to Build Faster, More Scalable AI Applications with Elastic and NVIDIA

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/accelerate-vector-search-for-enterprise-scale-ai-elastic-nvidia-image_small-6-a-31975.jpg" align=right hspace=4><b>An OnDemand Webinar</b><br>AI applications are only as powerful as the infrastructure behind them. Discover how leading organizations are accelerating search, eliminating performance bottlenecks, and building AI appli

Bank Info Security
CRITICALVulnerability

NVD CRITICAL: CVE-2016-20096 — Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated S...

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of pl

CVE-2016-20096
NIST NVD