CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

Multiple vulnerabilities in WordPress (July 20, 2026)

unknownknown exploitedpublic exploitCVE-2026-60137CVE-2026-63030
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
On July 17, 2026, WordPress released a patch for two vulnerabilities: CVE-2026-60137: a SQL injection (SQLi); CVE-2026-63030: this allows a security policy bypass. An attacker can exploit these two vulnerabilities, in combination, to gain a...

CSIRTS triage

vendor: WordPressproduct: WordPressSQL injectionAuthentication bypass
What
On July 17, 2026, WordPress released a patch for two vulnerabilities that allow SQL injection and security policy bypass.
Who is affected
Deployments of WordPress are affected.
Urgency
Remediation urgency is unknown but the vulnerabilities are critical and should be addressed promptly.
Action
Apply the patch released by WordPress for the identified vulnerabilities.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch WordPress

Get an email when a new WordPress advisory drops — max one per day, one-click unsubscribe.

Details

Source
CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity
unknown
Published
2026-07-20
Exploitation
Observed in the wild (CISA KEV)
Language
Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-60137coverage & exploitation statusNVD · CVE.org
CVE-2026-63030coverage & exploitation statusNVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

Recent advisories for WordPress

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from CERT-FR Alertes de sécurité