Critical Actively exploited

CVE-2026-60137

WordPress Core SQL Injection Vulnerability

What this means

Weakness: Unescaped input is placed into an SQL query, letting the attacker read or alter the database (SQL injection).
Likelihood: Exploitation is not hypothetical: CISA has observed it in the wild.

What to doTop priority: CISA sets the remediation deadline at 4 August 2026.

Read automatically from the CVSS vector, the weakness type (CWE) and the EPSS score. The technical description above remains the one published by NIST.

Published: 21 July 2026
CVSS: —
EPSS: 77.97% probability of exploitation within 30 days · above 100% of all CVEs
Weakness: CWE-89
CISA due date: 4 August 2026
Sources: cisa-kev

References

https://nvd.nist.gov/vuln/detail/CVE-2026-60137