Wordpress WordPress vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Wordpress WordPress: 5 record(s), with affected versions and fixes.

CVE-2026-87902 High · 8.1 KEV Urgent · 74 Public exploit CWE-98 Sep 22, 2026

WordPress Core Remote File Inclusion Vulnerability

An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

CVE-2026-63030 Critical · 9.8 KEV Urgent · 82 Public exploit CWE-436 Jul 17, 2026

WordPress Core Interpretation Conflict Vulnerability

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

CVE-2026-60137 Medium · 5.9 KEV Urgent · 70 Public exploit CWE-89 Jul 17, 2026

WordPress Core SQL Injection Vulnerability

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

CVE-2026-3906 Medium · 4.3 CWE-862 Mar 11, 2026

WordPress 6.9 - 6.9.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Note Creation via REST API

WordPress core is vulnerable to unauthorized access in versions 6.9 through 6.9.1. The Notes feature (block-level collaboration annotations) was introduced in WordPress 6.9 to allow editorial comments directly on posts in the block editor. However, the REST API `create_item_permissions_check()` method in the comments controller did not verify that the authenticated user has `edit_post` permission on the target post when creating a note. This makes it possible for authenticated attackers with Subscriber-level access to create notes on any post, including posts authored by other users, private posts, and posts in any status.

CVE-2016-10033 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-88 Dec 30, 2016

PHPMailer Command Injection Vulnerability

The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \" (backslash double quote) in a crafted Sender property.