Back to Zero Wire

CMS

Security briefings tagged with CMS

Reference

Stable briefings kept for reference. Reference doesn't mean every affected system has been patched.

Last checked

Update systems

WordPress SQL injection and RCE

CVE-2026-60137 · CVE-2026-63030

Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.

Read the briefingRead the blog post

Why it remains relevant

Vendor remediation and applicability guidance are stable, and active exploitation was not established in the cited sources. The record remains relevant to organizations that have not verified their WordPress update state.

What to do now

Confirm WordPress update status against the vendor release and patch guidance. Keep any compensating controls in place while remediation is completed.