MSRXWordPress vulnerabilities
3 WordPress flaws were confirmed exploited in the wild in the past 365 days. Patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-09-25 | CVE-2026-87902 WordPress Core WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. | 2026-09-28 |
| 2026-07-21 | CVE-2026-63030 WordPress Core WordPress Core Interpretation Conflict Vulnerability WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. | 2026-07-24 |
| 2026-07-21 | CVE-2026-60137 WordPress Core WordPress Core SQL Injection Vulnerability WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. | 2026-08-04 |
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.28 (live), refreshed every 12 hours.