WordPress SQL Injection Vulnerability CVE-2026-60137: Critical Patch Required Now
WordPress SQL Injection Vulnerability CVE-2026-60137: Critical Patch Required Now
Yesterday, the Cybersecurity and Infrastructure Security Agency added a WordPress Core SQL injection vulnerability to its Known Exploited Vulnerabilities catalog. This is CVE-2026-60137, and it's actively being exploited in the wild. If you run WordPress and haven't patched yet, attackers can use this flaw to inject malicious SQL commands and potentially execute code on your server. This isn't theoretical—it's happening now, and you need to treat it as urgent.
What This Vulnerability Actually Means for Your Business
The vulnerability exists in WordPress Core when a plugin or theme passes untrusted input without proper validation. An attacker doesn't need to log in to exploit this—they can attack from the internet directly. The real danger emerges when this flaw chains with another vulnerability (CVE-2026-63030) to deliver remote code execution on default WordPress installations. That means an attacker could gain complete control of your website, steal customer data, inject malware, or use your server to attack others.
What matters most here isn't understanding the technical mechanics—it's understanding the ownership problem. Many small business owners run WordPress but don't track which plugins or themes they're using or when updates arrive. The vulnerability sits quietly until someone exploits it, and by then the damage is done. CISA added this to the actively exploited list, which means defenders and attackers both know about it. The window for undetected compromise is closing fast.
Three Actions You Must Take Today
Step 1: Audit Your WordPress Installation
Log into your WordPress dashboard and check Settings > General to see your current version. Go to Dashboard > Updates to see what patches are available. Write down every plugin and theme you're running—this list matters more than you think because the vulnerability depends on what extensions you've installed. If you're not sure what you're running, take screenshots. You'll need this inventory to evaluate your risk.
Step 2: Apply All Available Security Updates
Update WordPress Core immediately to the latest version. Then update every active plugin and theme. Remove any plugins or themes you're not actively using—they create attack surface for no reason. CISA's BOD 26-04 guidance requires you to prioritize this update based on your system's internet exposure. If your WordPress site is public-facing and accepts any user input, treat this as maximum priority.
Step 3: Verify Your Patches and Document Your Changes
After updating, return to Dashboard > Updates and confirm no critical updates remain pending. Take another screenshot showing your current version and active plugins. Document the date and time you patched. This creates an audit trail that proves you acted on the advisory. CISA's Forensics Triage Requirements expect you to maintain records of when and how you addressed this vulnerability.
If You Can't Patch
If WordPress updates break your site or a critical plugin doesn't have a compatible update, you face a hard choice. Evaluate whether you can discontinue use of the vulnerable plugin or theme. If mitigations are unavailable and you can't patch, consider whether that WordPress installation should remain internet-accessible. BOD 26-04 guidance suggests you should take the site offline rather than leave it exploitable.
Protecting Yourself Going Forward
This vulnerability exposes a broader problem: WordPress security depends on staying current with patches and understanding your plugin ecosystem. Use Malwarebytes to scan for malware that may have already compromised your system while you were unpatched. Protect your WordPress admin credentials with LastPass, which generates strong unique passwords you won't have to remember.
More importantly, build the security awareness your team needs to catch these threats early. Pluralsight's free trial for individuals includes training on WordPress security fundamentals and vulnerability response. If you manage a team responsible for web infrastructure, Pluralsight for Teams offers structured learning paths for your security leads to understand how SQL injection works and why patching schedules matter.
Want to defend against this? Train your skills on Pluralsight and understand the vulnerabilities targeting your infrastructure.
The deadline for patching under BOD 26-04 guidance is August 4, 2026. That gives you two weeks to act if you haven't already. Treat this as your signal to audit everything running on WordPress across your business, not just one site.