CVE-2026-60137 · CVE-2026-63030
Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.
Last reviewed
Updates
Cloudflare updated its response with vulnerability and remediation guidance.
WordPress published the security release and Cloudflare published its WAF response.
Descripción general
Detalles
CVE-2026-60137 is a SQL-injection issue and CVE-2026-63030 is an unauthenticated code-execution issue associated with a REST API attack path. Their affected versions and conditions differ.
Managed WAF rules can mitigate known requests, but do not repair WordPress installations or replace vendor updates.
Risk
Affected sites can be compromised before sign-in. The July 20 review did not confirm active exploitation.
Affected deployments
WordPress sites running a release affected by either CVE. Check the security release for each flaw's version and configuration requirements.
Recommended action
Check each site's WordPress version and apply the vendor's update or backport guidance. Keep compensating controls in place during remediation.
Identify WordPress sites and compare their versions with the WordPress security release.
Apply the vendor update or backport guidance for each affected deployment.
Confirm that Internet-facing WordPress traffic follows the intended security controls during remediation.
Cloudflare coverage
Service status
No impact to Cloudflare. We do not use WordPress on our infrastructure.
Product coverage
Cloudflare has WAF rules for documented WordPress exploit paths. They are a compensating control, not a replacement for updating WordPress.
Review your WAF configuration to determine whether you are protected.
Evidence and sources
Vendor advisory
Security updates and backports for both WordPress flaws.
CVE records
Technical research
Cloudflare's response documents the two WAF rules and their respective attack paths.