VENDOR

WordPress vulnerabilities: CVEs, exploitation and patches

Every WordPress CVE reviewed by Diras Labs analysts, newest first, with exploitation status and fixes.

CVE-2026-65640
WordPress PostScript upload remote code execution via upload_files WordPress WordPress · Sep 29, 2026
- PoC PUBLIC
- PATCH AVAILABLE
HIGH 8.8
CVE-2026-64638
WordPress pre-auth reflected XSS on login page WordPress WordPress · Sep 29, 2026
- PoC PUBLIC
HIGH 8.9
CVE-2026-60137
WordPress Core SQL injection via author__not_in parameter WordPress Core · Sep 29, 2026
- CISA KEV
- EXPLOITED
- PoC PUBLIC
- PATCH AVAILABLE
MEDIUM 5.9
CVE-2026-63030
WordPress Core REST API route confusion remote code execution WordPress Core · Sep 29, 2026
- CISA KEV
- EXPLOITED
- PoC PUBLIC
- PATCH AVAILABLE
CRITICAL 9.8
CVE-2026-87902
Remote file inclusion via page-template resolution (get_page_template) WordPress Core · Sep 29, 2026
- CISA KEV
- EXPLOITED
- PoC PUBLIC
- PATCH AVAILABLE
HIGH 8.1