Loading story…
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation, including two WordPress Core flaws that can be chained from SQL injection to unauthenticated remote code execution, the critical Langflow RCE CVE-2026-0770, and DD-WRT flaw CVE-2021-27137. The WordPress issues, CVE-2026-60137 and CVE-2026-63030, affect default installations and have drawn warnings from CERT-FR and NCSC-NL because public proof-of-concept code is available and broader exploitation is considered likely or imminent.
CVE-2026-60137 stems from improper sanitization of the author__not_in parameter in WP_Query when plugins or themes pass untrusted input, affecting WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. Organizations were urged to prioritize patching those versions, update Langflow, and upgrade DD-WRT builds older than 45724; where immediate WordPress patching is not possible, defenders were advised to restrict unauthenticated access to the REST batch API endpoint, including paths such as /wp-json/batch/v1 or requests containing rest_route=/batch/v1.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-21, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: WordPress flaws CVE-2026-60137 and CVE-2026-63030, Langflow RCE CVE-2026-0770, and DD-WRT flaw CVE-2021-27137. The KEV additions indicated confirmed active exploitation and elevated urgency for remediation.
CERT-FR and NCSC-NL warned that public proof-of-concept code was available for CVE-2026-60137 and that mass exploitation was likely or imminent. The guidance also recommended blocking unauthenticated access to the WordPress REST batch API endpoint if patching was not immediately possible.
WordPress released patched versions 6.8.6, 6.9.5, and 7.0.2 to address CVE-2026-60137, a core SQL injection flaw affecting multiple branches. The vulnerability can be chained with CVE-2026-63030 for unauthenticated remote code execution on default installations.
KEVIntel observed exploitation of Langflow CVE-2026-0770 beginning on 2026-06-27, with more than 220 attempts from 64 unique source IPs. Some attacks reportedly progressed beyond reconnaissance to deploy malware and search for AWS credentials, environment variables, and container metadata.
The CVE record for CVE-2026-0770 was published, describing a critical unauthenticated remote code execution flaw in Langflow's validate endpoint via the exec_globals parameter. The record states that Langflow 1.4.2 is affected and that successful exploitation can lead to arbitrary code execution as root.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
thecyberthrone.in
Open sourcesecurityaffairs.com
Open sourcecodeby.net
Open sourcebleepingcomputer.com
Open sourcesecurityonline.info
Open sourcecve.circl.lu
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Aug 26, 2026
WordPress released security updates for two core vulnerabilities, **CVE-2026-63030** and **CVE-2026-60137**, that can be chained to make a blind SQL injection remotely reachable without authentication and, in some cases, lead to **remote code execution**. The issue, dubbed **`wp2shell`**, stems from REST API batch-route confusion in the `/wp-json/batch/v1` endpoint combined with SQL injection, affecting WordPress versions **6.9.0 through 6.9.4** and **7.0.0 through 7.0.1**. Researchers said the route-confusion flaw carries a **CVSS 9.8** rating, while the second SQL injection bug is rated **CVSS 5.9**. WordPress fixed the flaws in **6.9.5** and **7.0.2**, and also backported the SQL injection fix to **6.8.6**. The vulnerabilities were reported by Adam Kues of Assetnote through the WordPress HackerOne program, and while exploitation had not been confirmed at the time of disclosure, a public proof of concept later became available, increasing the risk of rapid weaponization. Administrators were urged to verify that forced automatic updates succeeded and, if immediate patching was not possible, to apply mitigations such as blocking the REST batch endpoint with a WAF.
Jul 31, 2026
A series of critical vulnerabilities have been disclosed affecting a wide range of popular software platforms, including WordPress plugins, web frameworks, developer tools, and enterprise applications. Notable issues include unauthenticated remote code execution (RCE) flaws in Next.js (CVE-2025-66478), WordPress core (CVE-2025-6389), and the ACF Extended plugin (CVE-2025-13486), as well as privilege escalation and authentication bypass vulnerabilities in the WP Directory Kit plugin (CVE-2025-13390) and cPanel. Several of these vulnerabilities are reported to be under active exploitation, with proof-of-concept code available for some, increasing the urgency for immediate patching and mitigation. Other significant disclosures include a high-severity flaw in Vim for Windows (CVE-2025-66476) allowing arbitrary code execution, a critical SQL injection chain in Synology BeeStation, and a directory traversal vulnerability in cPanel that could lead to full server takeover. Additional advisories cover issues in lz4-java, Longwatch OT surveillance, Django, Elementor, Apache Struts, nopCommerce, and OpenVPN, with many rated as critical or high severity by CVSS. Organizations are strongly advised to review affected products and apply security updates promptly to mitigate the risk of exploitation.
Jun 29, 2026