CVE-2026-60137

WordPress Core Vulnerability

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

CVSS Score

9.8

CRITICAL

Published

21 Jul 2026 00:00

Modified

N/A

Vendor

WordPress

Product

Core

Source

CIRCL

Affected Versions

Fix Vendor Patch / Mitigation Available

Weaknesses (CWE)

CWE-89

References

nvd.nist.gov /vuln/detail/CVE-2026-60137 cve.circl.lu /cve/CVE-2026-60137 cve.mitre.org /cgi-bin/cvename.cgi vuldb.com /

Affected Systems

WordPress

Core

WordPress

Core

External Links

NVD Database CIRCL CISA KEV

KEV Status

Known Exploited Vulnerability