Multiple vulnerabilities in WordPress (July 20, 2026)

unknownpublic exploitCVE-2026-60137 CVE-2026-63030

Multiple vulnerabilities have been discovered in WordPress. They allow an attacker to cause remote arbitrary code execution, SQL injection (SQLi), and security policy bypass. CERT-FR is aware of a public proof of concept.

CSIRTS triage

vendor: WordPress product: WordPress Remote code execution SQL injection Authentication bypass

What: Multiple vulnerabilities have been discovered in WordPress that allow an attacker to cause remote arbitrary code execution, SQL injection, and security policy bypass.
Who is affected: Deployments of WordPress are affected.
Urgency: Remediation urgency is unknown but exploitation is possible given the nature of the vulnerabilities.
Action: Update to the latest version of WordPress.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch WordPress

Get an email when a new WordPress advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Avis de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2026-07-20
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0904/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2026-60137EPSS puts this in the most-targeted tier (79.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
Exploitation likely imminentCVE-2026-63030EPSS puts this in the most-targeted tier (98.4% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-60137	coverage & exploitation status	NVD · CVE.org
CVE-2026-63030	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

critical[NEW] [critical] WordPress: Multiple vulnerabilities allow code executioncert-bund
unknownDSA-6399-1 wordpress - security updatedebian
unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
criticalexploitedCVE-2026-60137: WordPress Core SQL Injection Vulnerabilitycisa-kev
criticalexploitedCVE-2026-63030: WordPress Core Interpretation Conflict Vulnerabilitycisa-kev
unknownWordPress Multiple Vulnerabilitieshkcert
unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl
criticalexploitedCVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint r…nvd
mediumexploitedCVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly san…nvd

Recent advisories for WordPress

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-6453: The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to …nvd · 2026-08-01
mediumCVE-2026-18435: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
mediumCVE-2026-18344: The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site …nvd · 2026-08-01
mediumCVE-2026-18062: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
mediumCVE-2026-18059: The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to…nvd · 2026-08-01
mediumCVE-2026-17605: The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vul…nvd · 2026-08-01