上次审核
更新
WordPress SQL injection and RCE
CVE-2026-60137 · CVE-2026-63030
Two related WordPress flaws can expose database contents and allow unauthenticated code execution through distinct SQL-injection and REST API attack paths.
风险
Affected sites can be compromised before sign-in. The July 20 review did not confirm active exploitation.
建议操作
Check each site's WordPress version and apply the vendor's update or backport guidance. Keep compensating controls in place during remediation.