CVE-2026-60137 · CVE-2026-63030
Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.
Last checked
Update chronology
Cloudflare updated its response with vulnerability and remediation guidance.
WordPress published the security release and Cloudflare published its WAF response.
Overview
What happened
CVE-2026-60137 is a SQL-injection issue and CVE-2026-63030 is an unauthenticated code-execution issue associated with a REST API attack path. Their affected versions and conditions differ.
The cited WordPress release provides the authoritative remediation and backport information. The sources reviewed for this reference record did not establish active exploitation.
Managed WAF rules can mitigate known requests, but do not repair WordPress installations or replace vendor updates.
Why it remains relevant
Vendor remediation and applicability guidance are stable, and active exploitation was not established in the cited sources. The record remains relevant to organizations that have not verified their WordPress update state.
Who should investigate
Organizations operating WordPress sites. The two issues have different version and configuration conditions; the WordPress security release is authoritative for applicability.
What to do now
Confirm WordPress update status against the vendor release and patch guidance. Keep any compensating controls in place while remediation is completed.
Identify WordPress sites and compare their versions with the WordPress security release.
Apply the vendor update or backport guidance for each affected deployment.
Confirm that Internet-facing WordPress traffic follows the intended security controls during remediation.
Cloudflare coverage
Product coverage
Cloudflare has WAF rules for documented WordPress exploit paths. They are a compensating control, not a replacement for updating WordPress.
Review your WAF configuration to determine whether you are protected.
Service status
No impact to Cloudflare. We do not use WordPress on our infrastructure.
Evidence and sources
Vendor advisory
WordPress's release contains security-update and backport guidance for both issues.
CVE records
Canonical identifiers for the SQL-injection and code-execution paths.
Technical research
Cloudflare's response documents the two WAF rules and their respective attack paths.
Exploit evidence
Active exploitation was not established in the cited WordPress release or Cloudflare response.