CVE-2026-60137CISA KEVEPSS p93.0%

CVE-2026-60137WordPress Core SQL Injection Vulnerability

WordPress / Core

Description

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Scoring

CVSS 5.9 ()
VectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS5.91% probability of exploitation · percentile 93.0% · 2026-10-05T12:00:23Z
Last modified2026-07-29

CISA KEV entry

Added to KEV: 2026-07-21

Sourced from NVD + CISA KEV + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.