NewsCERT-FR (ANSSI)
Multiples vulnérabilités dans WordPress (20 juillet 2026)
Linked advisories
- CVE-2026-63030WordPress: SQL-Injection
- CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
- CVE-2026-60137WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
- CVE-2026-60137Debian wordpress: security update
- CVE-2026-60137WordPress: Mehrere Schwachstellen ermöglichen Codeausführung
- CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- CVE-2026-63030WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
- CVE-2026-60137WordPress Core — WordPress Core SQL Injection Vulnerability
- CVE-2026-60137WordPress: SQL-Injection
- CVE-2026-63030WordPress Core — WordPress Core Interpretation Conflict Vulnerability
Affected vendors and products
More on WordPress
Other advisories
- MediumCVE-2026-115955bPlugins Advanced Post Block - Post Grid for WordPress block editor: Cross-Site-Scripting (XSS)
- MediumCVE-2026-115955bPlugins Advanced Post Block - Post Grid for WordPress block editor: Cross-Site-Scripting (XSS)
- HighCVE-2026-55826Stape-io Gtm-server-side-wordpress-plugin: Offenlegung vertraulicher Informationen
- HighCVE-2026-55826Stape-io Gtm-server-side-wordpress-plugin: Offenlegung vertraulicher Informationen
- Not ratedosv:CVE-2026-55826Customer Order Data Exposed via Unauthenticated gtm_server_side_order_id Cookie Manipulation in GTM Server Side WordPress Plugin
- MediumCVE-2026-114696miniOrange Page Restriction WordPress (WP): fehlende Autorisierung
- MediumCVE-2026-114696miniOrange Page Restriction WordPress (WP): fehlende Autorisierung
- LowCVE-2026-88849MasterStudy LMS WordPress Plugin: fehlerhafte Autorisierung
Other news entries
- WordPress sites compromised after TeamUpdraft credential exposureNewsCSO Online
- Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress SitesNewsThe Hacker News
- Stolen UpdraftCentral keys used to backdoor WordPress sitesNewsBleepingComputer
- WordPress SEO plugin Rank Math compromised to backdoor websitesNewsBleepingComputer
- Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring BackdoorNewsThe Hacker News
- Rank Math PRO WordPress Plugin Compromised in Supply Chain AttackNewsSecurityWeek
- Bricksforge WordPress Plugin Vulnerability Exploited in the WildNewsSecurityWeek
- Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCENewsThe Hacker News
Source: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/
ID