WordPress Multiple Vulnerabilities
CSIRTS triage
- What
- Multiple vulnerabilities exist in WordPress.
- Who is affected
- Deployments of WordPress are affected.
- Urgency
- Remediation is important as these vulnerabilities could be exploited in the future.
- Action
- Update to the latest version of WordPress.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch WordPress
Get an email when a new WordPress advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://www.hkcert.org/security-bulletin/wordpress-multiple-vulnerabilities_20260720
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation likely imminentCVE-2026-63030EPSS puts this in the most-targeted tier (98.1% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
- Exploitation likely imminentCVE-2026-60137EPSS puts this in the most-targeted tier (78.0% 30-day exploitation probability). Prioritize alongside KEV items. Riskier than 100% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-63030 | coverage & exploitation status | NVD · CVE.org |
| CVE-2026-60137 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- critical[NEW] [critical] WordPress: Multiple vulnerabilities allow code executioncert-bund
- unknownDSA-6399-1 wordpress - security updatedebian
- unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- criticalexploitedCVE-2026-60137: WordPress Core SQL Injection Vulnerabilitycisa-kev
- criticalexploitedCVE-2026-63030: WordPress Core Interpretation Conflict Vulnerabilitycisa-kev
- unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
- unknownMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-avis
- unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl
- criticalexploitedCVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint r…nvd
- mediumexploitedCVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly san…nvd
More from HKCERT Security Bulletins
- unknownIBM WebSphere Products Multiple Vulnerabilities2026-07-30
- unknownGoogle Chrome Multiple Vulnerabilities2026-07-30
- unknownCisco Secure Firewall Management Center Software Information Disclosure Vulnerability2026-07-30
- unknownNode.js Multiple Vulnerabilities2026-07-30
- unknownXen Multiple Vulnerabilities2026-07-30