The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has classified a critical SQL injection vulnerability in WordPress Core, tracked as CVE-2026-60137, as one of its Known Exploited Vulnerabilities (KEV) due to its active exploitation in real-world attacks.
This vulnerability affects the core functionality of WordPress when themes or plugins fail to properly validate untrusted input in database queries, allowing attackers to manipulate SQL statements.
CISA has highlighted that this issue presents a significant risk to organizations using WordPress, especially those with instances exposed to the internet, as it can be combined with other vulnerabilities to achieve full system compromise.
CISA Warns WordPress Core SQL Injection Vulnerability
According to the KEV advisory, CVE-2026-60137 can be chained with CVE-2026-63030, an interpretation conflict vulnerability in WordPress Core, which may lead to unauthenticated remote code execution (RCE) on default installations.
This ability to combine vulnerabilities substantially increases the severity of the situation, allowing attackers to go beyond simple data theft and directly execute malicious code on compromised servers.
The root problem falls under CWE-89 (SQL Injection), a long-standing vulnerability that remains problematic due to inadequate input handling practices across various themes and plugins.
CISA added both of these vulnerabilities to the KEV catalog on July 21, 2026, highlighting the urgent need for remediation. Federal Civilian Executive Branch (FCEB) agencies are required to implement patches or mitigations by August 4, 2026, as per Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on associated risks.
The agency also recommends that organizations conduct comprehensive assessments of asset exposure, focus on internet-facing systems, and adhere to mitigation guidance provided by vendors. In cases where patches are not immediately available, organizations should consider temporary mitigations or suspend affected services to minimize exposure.
The exploitation of vulnerabilities in WordPress Core is particularly alarming given the platform’s extensive use across enterprises, government agencies, and small businesses.
Threat actors often target WordPress due to its large plugin ecosystem and frequent misconfigurations, which can create additional attack vectors.
The reliance on third-party themes or plugins to securely handle user input provides an opening for attackers to inject malicious SQL queries, potentially resulting in credential theft, database manipulation, or lateral movement within the hosting environment.
Security researchers have observed that exploitation attempts are likely automated, using scanning tools to identify vulnerable WordPress installations on a large scale.
Once identified, attackers can exploit the SQL injection flaw to extract sensitive data or prepare for further exploitation through chained vulnerabilities. The inclusion of this flaw in CISA’s KEV catalog indicates confirmed exploitation in the wild, making it a high-priority issue for security defenders.
Organizations are strongly advised to update their WordPress installations to the latest patched versions, audit plugins and themes for secure coding practices, and implement web application firewalls (WAFs) to detect and block malicious input patterns.
Additionally, enabling database query logging and monitoring for unusual behavior can aid in early detection of exploitation attempts. As threat actors continue to exploit common web vulnerabilities, proactive patching and layered defenses are essential for reducing risk and maintaining the integrity of web infrastructure.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
 has classified a critical SQL injection vulnerability in WordPress Core, tracked as CVE-2026-60137, as one of its Known Exploited Vulnerabilities (KEV)){kind=link}