TL;DR
A severe SQL injection vulnerability in WordPress core, identified as CVE-2026-60137, is currently being exploited by attackers. This flaw allows unauthorized data access and potential site compromise, emphasizing the need for immediate patching.
Cybersecurity officials have confirmed that CVE-2026-60137, a critical SQL injection vulnerability in the WordPress core, is being actively exploited by malicious actors. This flaw allows attackers to execute unauthorized database commands, potentially compromising affected websites. The vulnerability is significant because WordPress powers over 40% of the web, making this a widespread threat.
According to the Cybersecurity and Infrastructure Security Agency (CISA), CVE-2026-60137 exists when a plugin or theme passes untrusted input to a parameter in WordPress core, enabling SQL injection attacks. The vulnerability can be chained with CVE-2026-63030, an additional flaw, to allow unauthenticated attackers to execute malicious database queries. Security researchers have observed active exploitation campaigns targeting vulnerable sites, with attackers gaining access to sensitive data or taking control of compromised servers. WordPress developers have issued an emergency security update, urging site administrators to patch immediately to prevent further damage. The flaw was publicly disclosed in late March 2026, but exploitation has been confirmed only recently through threat intelligence reports.Implications of the Exploited WordPress Vulnerability
This active exploitation of CVE-2026-60137 poses a serious risk to millions of WordPress sites worldwide. Attackers can manipulate database queries, leading to data theft, defacement, or complete site takeover. The flaw’s chaining with CVE-2026-63030 amplifies the threat, as it allows unauthenticated attackers to exploit the vulnerability without needing user credentials. The widespread use of WordPress amplifies the potential impact, making timely patching critical to prevent mass compromises and data breaches.
WordPress Security: Essential WordPress Security Plugins and Step-by-Step Guide to Securing Your WordPress Website and Stopping Hackers (WordPress Security, WordPress Plugins, WordPress Book 1)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Details of the WordPress Core SQL Injection Flaw
CVE-2026-60137 was identified as a SQL injection vulnerability within the WordPress core, specifically when plugins or themes pass untrusted input directly to database queries. This flaw was disclosed publicly in late March 2026, with security researchers warning of its severity. The vulnerability can be exploited when malicious actors send crafted input to vulnerable endpoints, enabling them to execute arbitrary SQL commands. The flaw can be combined with CVE-2026-63030, another vulnerability in the same ecosystem, to allow unauthenticated access. WordPress has issued an emergency update, but many sites remain unpatched, leaving them vulnerable to active attacks. The exploitation appears to target popular plugins and themes that do not properly sanitize user input.
“The active exploitation of CVE-2026-60137 underscores the urgency for WordPress administrators to apply security updates immediately.”
— CISA spokesperson
database security for WordPress
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Unclear Scope and Extent of Current Exploits
While active exploitation has been confirmed, the full scope of affected sites and the specific methods used by attackers are still emerging. It is not yet clear how widespread the attacks are or which plugins or themes are most targeted. Security firms are still analyzing attack patterns, and some sites may remain vulnerable due to delayed patching or unawareness of the flaw.
cybersecurity tools for WordPress sites
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Immediate Patching and Monitoring Recommendations
WordPress site administrators are urged to update to the latest security release immediately. Security teams recommend monitoring server logs for suspicious activity and disabling vulnerable plugins or themes until updates are applied. Ongoing threat intelligence efforts aim to identify attack groups and develop detection signatures. Further advisories are expected as more details about the exploitation campaigns become available.
website vulnerability scanner
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Key Questions
What is CVE-2026-60137?
CVE-2026-60137 is a critical SQL injection vulnerability in WordPress core that allows attackers to execute malicious database queries, potentially leading to data theft or site takeover.
How do I know if my WordPress site is vulnerable?
Sites using outdated WordPress versions or unpatched plugins/themes passing untrusted input are vulnerable. Check your WordPress version and update immediately if necessary.
What should I do if my site is compromised?
Immediately update WordPress and all plugins/themes, review server logs for suspicious activity, and consider restoring from backups if data has been exfiltrated or the site is defaced.
Are all WordPress sites at risk?
Sites that have not applied recent updates or use vulnerable plugins are at higher risk. The vulnerability affects core functionality but can be mitigated through prompt patching.
Source: kev
