CVE-2026-60137 · Critical · CISA KEV

WordPress Core SQLi: Chained RCE for Unauthenticated Attackers

Threat Engine Auto-Feed · data current as of 2026-07-21

A SQL injection vulnerability in WordPress Core, when untrusted input is passed by a plugin or theme, can be chained with CVE-2026-63030. This allows an unauthenticated attacker to achieve remote code execution on default WordPress installations. This vulnerability is listed in CISA KEV, indicating active exploitation in the wild.

  • CVSS:
  • EPSS percentile: 0.89474
  • Exploitation pressure: 79/100 (Critical)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 89th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability is a SQL injection, which occurs when an application constructs a SQL query using user-supplied input without proper sanitization. An attacker can inject malicious SQL code into the input, causing the database to execute unintended commands, potentially leading to data manipulation, information disclosure, or, in this case, remote code execution when chained with another vulnerability.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations using WordPress Core, especially those with custom plugins or themes that might handle untrusted input.
  • Financial services and Technology sectors, due to documented targeting by relevant threat actors.

Misconfigurations that escalate it

  • Using outdated or unpatched WordPress Core versions.
  • Custom plugins or themes that do not properly sanitize user-supplied input before passing it to database queries.

High-impact scenarios

  • Unauthenticated remote code execution on WordPress installations, leading to full system compromise.
  • Data theft, website defacement, or further network penetration from compromised WordPress servers.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor WordPress access logs for unusual activity, especially related to SQL query parameters.
  • Scan WordPress installations for known vulnerable plugins or themes.
  • Implement Web Application Firewalls (WAFs) with rules designed to detect and block SQL injection attempts.

Contain

  • Isolate affected WordPress instances from the network to prevent further compromise.
  • Review and audit custom plugins and themes for insecure input handling practices.

Patch

  • Apply the latest security updates for WordPress Core immediately.
  • Update or remove any vulnerable plugins or themes that pass untrusted input to database queries.

Frontier verdict — Critical

Critical priority due to active exploitation (CISA KEV) and potential for unauthenticated remote code execution on WordPress Core.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.