🔴 Critical | Source: CISA Known Exploited Vulnerabilities
A SQL injection vulnerability in WordPress Core allows malicious input passed by a plugin or theme to compromise the database layer. When chained with CVE-2026-63030, an unauthenticated attacker can achieve remote code execution on default WordPress installations with no prior access required. This is actively exploited in the wild and carries a CISA remediation deadline of 4 August 2026.
Security Architect’s Take: Patch WordPress Core immediately and audit all third-party plugins and themes for untrusted input handling; consider placing WordPress instances behind a WAF with SQL injection and RCE rules enabled, and restrict outbound network access from web servers to limit post-exploitation blast radius.
Original advisory: CVE-2026-60137: WordPress Core