Core vulnerabilities
3 published alerts for WordPress Core.
WordPress Core Remote File Inclusion Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-87902). WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA remediation due date: 2026-09-28. If you need help checking exposure, call (864) 335-9223.
WordPress Core Interpretation Conflict Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-63030). WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA remediation due date: 2026-07-24. If you need help checking exposure, call (864) 335-9223.
WordPress Core SQL Injection Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-60137). WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA remediation due date: 2026-08-04. If you need help checking exposure, call (864) 335-9223.