CISA Adds WordPress SQL Injection to KEV List

WordPress Core is currently subject to active exploitation following the discovery of a SQL injection vulnerability, tracked as CVE-2026-60137. CISA has officially added this flaw to its Known Exploited Vulnerabilities catalog, confirming that it is being used in real-world attacks. Because this vulnerability can be chained with CVE-2026-63030, attackers may be able to gain remote code execution on default installations of the platform.

What's at Risk

The vulnerability affects WordPress Core, the foundation of a significant portion of the web. Organizations running internet-facing WordPress instances are at the highest risk, as these environments are often targeted by automated scanning tools looking for unpatched software.

Because the vulnerability relies on the way plugins or themes pass untrusted input to the core software, any site utilizing third-party extensions that do not properly sanitize user-supplied data may be exposed. The potential for remote code execution makes this a high-priority issue for any server administrator or security team managing WordPress deployments.

How the Flaw Works

A SQL injection, or CWE-89, occurs when an application fails to properly neutralize special elements used in an SQL command. In general terms, this type of weakness allows an unauthorized party to manipulate the database queries that an application executes. By injecting malicious SQL statements into input fields or parameters, an attacker can trick the database into performing unauthorized actions.

Typically, this allows an attacker to bypass authentication, access sensitive data stored within the database, or modify existing records. When chained with other vulnerabilities, such as those allowing remote code execution, the impact escalates from simple data exposure to a full system compromise, granting the attacker control over the underlying server environment.

How to Protect Your Systems

• Apply all available security mitigations provided by the vendor immediately to address the SQL injection flaw.
• Ensure compliance with CISA’s BOD 26-04 directive, which mandates remediation for this vulnerability by August 4, 2026.
• Conduct a thorough review of all installed plugins and themes to ensure they are updated and follow modern secure coding practices.
• Restrict internet exposure for administrative interfaces and sensitive backend directories where possible.
• Implement rigorous logging and monitoring to detect anomalous database queries or unexpected file executions on your web server.
• Review and adhere to CISA’s Forensics Triage Requirements to ensure you can identify potential indicators of compromise if a breach has already occurred.

The inclusion of this flaw in the CISA KEV catalog signals that the threat is active and the window for remediation is closing. Given the potential for remote code execution, organizations must prioritize patching to prevent unauthorized access. Failure to address this vulnerability before the August 4, 2026, deadline leaves your infrastructure exposed to ongoing exploitation attempts that could lead to complete system takeover.