[NEW] [critical] WordPress: Multiple vulnerabilities allow code execution

criticalpublic exploitCVE-2026-60137 CVE-2026-63030

A remote, anonymous attacker can exploit multiple vulnerabilities in WordPress to execute arbitrary program code.

CSIRTS triage

vendor: WordPress product: WordPress Remote code execution

What: Multiple vulnerabilities allow remote code execution.
Who is affected: Remote, anonymous attackers targeting WordPress installations.
Urgency: Remediation is urgent due to the critical severity of the vulnerabilities.
Action: Update to the latest version of WordPress.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch WordPress

Get an email when a new WordPress advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-Bund (BSI) Security Advisories (DE · national-cert · site)
Severity: critical
Published: 2026-07-24
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-2409

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Exploitation likely imminentCVE-2026-60137EPSS puts this in the most-targeted tier (79.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
Exploitation likely imminentCVE-2026-63030EPSS puts this in the most-targeted tier (98.4% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-60137	coverage & exploitation status	NVD · CVE.org
CVE-2026-63030	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownDSA-6399-1 wordpress - security updatedebian
unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
criticalexploitedCVE-2026-60137: WordPress Core SQL Injection Vulnerabilitycisa-kev
criticalexploitedCVE-2026-63030: WordPress Core Interpretation Conflict Vulnerabilitycisa-kev
unknownWordPress Multiple Vulnerabilitieshkcert
unknownMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-avis
unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl
criticalexploitedCVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint r…nvd
mediumexploitedCVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly san…nvd

Recent advisories for WordPress

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

mediumCVE-2026-6453: The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to …nvd · 2026-08-01
mediumCVE-2026-18435: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
mediumCVE-2026-18344: The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site …nvd · 2026-08-01
mediumCVE-2026-18062: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
mediumCVE-2026-18059: The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to…nvd · 2026-08-01
mediumCVE-2026-17605: The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vul…nvd · 2026-08-01