Threat intelligence / Vulnerability
CVE-2026-60137
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Vulnerability
TypeVulnerability
External ID—
First seen2026-07-21
Last seen2026-07-21
Confidence
—
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Labels
CISA KEV context
Vendor / productWordPress Core
Added2026-07-21
Due date2026-08-04
7 recorded
Relationships
2 external