Loading story…
CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation, including two WordPress Core flaws that can be chained from SQL injection to unauthenticated remote code execution, the critical Langflow RCE CVE-2026-0770, and DD-WRT flaw CVE-2021-27137. The WordPress issues, CVE-2026-60137 and CVE-2026-63030, affect default installations and have drawn warnings from CERT-FR and NCSC-NL because public proof-of-concept code is available and broader exploitation is considered likely or imminent.
CVE-2026-60137 stems from improper sanitization of the author__not_in parameter in WP_Query when plugins or themes pass untrusted input, affecting WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. Organizations were urged to prioritize patching those versions, update Langflow, and upgrade DD-WRT builds older than 45724; where immediate WordPress patching is not possible, defenders were advised to restrict unauthenticated access to the REST batch API endpoint, including paths such as /wp-json/batch/v1 or requests containing rest_route=/batch/v1.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-07-21, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog: WordPress flaws CVE-2026-60137 and CVE-2026-63030, Langflow RCE CVE-2026-0770, and DD-WRT flaw CVE-2021-27137. The KEV additions indicated confirmed active exploitation and elevated urgency for remediation.
CERT-FR and NCSC-NL warned that public proof-of-concept code was available for CVE-2026-60137 and that mass exploitation was likely or imminent. The guidance also recommended blocking unauthenticated access to the WordPress REST batch API endpoint if patching was not immediately possible.
WordPress released patched versions 6.8.6, 6.9.5, and 7.0.2 to address CVE-2026-60137, a core SQL injection flaw affecting multiple branches. The vulnerability can be chained with CVE-2026-63030 for unauthenticated remote code execution on default installations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WordPress released **7.0.2** to fix two core vulnerabilities that can be chained into unauthenticated remote code execution, including **CVE-2026-63030** and **CVE-2026-60137**. The flaws affect default WordPress installations without plugins, with the RCE path impacting **6.9.0 through 6.9.4**, **7.0.0 through 7.0.1**, and **7.1 beta**, while the SQL injection issue also affects the **6.8** branch. WordPress issued backported fixes in **6.9.5**, **6.8.6**, and **7.1 Beta 2**, enabled forced auto-updates for affected sites, and said the attack chain abuses the REST API batch endpoint to trigger route confusion, bypass request handling restrictions, and reach SQL injection that can lead to full site compromise. Security vendors moved quickly to contain exposure as public technical details began to emerge. Cloudflare deployed WAF protections for both CVEs for all customers and Wordfence added firewall coverage for premium users, but both stressed that filtering is only a temporary mitigation and that patching is the primary remediation. Researchers attributed the discovery to Adam Kues of Searchlight Cyber's Assetnote team, and while early reporting said no in-the-wild exploitation had been confirmed, a public GitHub proof of concept later demonstrated unauthenticated access to the vulnerable batch endpoint and blind SQL injection against affected versions, increasing the likelihood of rapid attacker weaponization.
Jul 22, 2026
A series of critical vulnerabilities have been disclosed affecting a wide range of popular software platforms, including WordPress plugins, web frameworks, developer tools, and enterprise applications. Notable issues include unauthenticated remote code execution (RCE) flaws in Next.js (CVE-2025-66478), WordPress core (CVE-2025-6389), and the ACF Extended plugin (CVE-2025-13486), as well as privilege escalation and authentication bypass vulnerabilities in the WP Directory Kit plugin (CVE-2025-13390) and cPanel. Several of these vulnerabilities are reported to be under active exploitation, with proof-of-concept code available for some, increasing the urgency for immediate patching and mitigation. Other significant disclosures include a high-severity flaw in Vim for Windows (CVE-2025-66476) allowing arbitrary code execution, a critical SQL injection chain in Synology BeeStation, and a directory traversal vulnerability in cPanel that could lead to full server takeover. Additional advisories cover issues in lz4-java, Longwatch OT surveillance, Django, Elementor, Apache Struts, nopCommerce, and OpenVPN, with many rated as critical or high severity by CVSS. Organizations are strongly advised to review affected products and apply security updates promptly to mitigate the risk of exploitation.
Jun 29, 2026
Two high-severity vulnerabilities have been disclosed in widely deployed WordPress plugins, exposing internet-facing sites to **unauthenticated compromise**. `CVE-2026-3584` affects **Kali Forms** through version `2.4.9` and allows **remote code execution** because user-controlled input can be mapped into internal placeholder storage and later invoked via `call_user_func` in the `form_process` path. The issue is classified as `CWE-94` and carries a `CVSS 3.1` score with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating critical impact on confidentiality, integrity, and availability. A second flaw, `CVE-2026-4038`, affects **Aimogen Pro** through version `2.7.5` and enables **unauthenticated privilege escalation** through an arbitrary function call in `aiomatic_call_ai_function_realtime` caused by a missing capability check. According to the disclosure, attackers can invoke WordPress functions such as `update_option` to change the default registration role to administrator and enable user registration, effectively creating a path to full site takeover. The vulnerability is tracked as `CWE-862` and was likewise rated with a high-impact `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026