SQL Injection in WordPress Core (CVE‑2026‑60137) Enables Remote Code Execution When Chained with CVE‑2026‑63030
What It Is – WordPress core fails to properly sanitize input supplied by a plugin or theme, creating a SQL‑injection flaw (CVE‑2026‑60137). When combined with CVE‑2026‑63030, an unauthenticated attacker can achieve remote code execution on default installations.
Exploitability – Publicly disclosed; proof‑of‑concept code is available. The chained attack requires the second vulnerability, but both are unpatched in many sites, making exploitation feasible.
Affected Products – WordPress core (all versions prior to the vendor‑released fix).
Why It Matters for Trust & Control Assurance
- Application security controls – The flaw tests whether you have documented processes for secure code review, input validation, and timely patching of core software.
- Continuous monitoring – Demonstrating that vulnerable components are identified and remediated in near‑real time provides defensible audit evidence.
- Supply‑chain diligence – Plugins and themes are third‑party extensions; their interaction with core code must be governed by a vendor‑risk program that can surface unsafe data flows.
Recommended Actions
- Apply the WordPress core update that resolves CVE‑2026‑60137 immediately.
- Review all installed plugins and themes for unsafe input handling; update or replace any that cannot be hardened.
- Deploy a web‑application firewall (WAF) with rules that detect anomalous SQL queries.
- Record remediation steps in your control‑evidence repository and map the fix to the “application security” control objective in your chosen framework.
Source: CISA KEV – CVE‑2026‑60137