Live Web Security Brief for July 30, 2026: APIs, WordPress, and Application Risk

CVE-2026-60137: WordPress Core SQL Injection Vulnerability

CISA Known Exploited Vulnerabilities | July 21, 2026 | Known Exploited | WordPress Core

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Why it matters: WordPress Core may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

CISA remediation date: 2026-08-04. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Confirm whether the vulnerable route, plugin, framework, or API behavior is enabled and public.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability

CISA Known Exploited Vulnerabilities | July 21, 2026 | Known Exploited | WordPress Core

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Why it matters: WordPress Core may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.

CISA remediation date: 2026-07-24. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance…

Operational focus: Patch the component, test authentication and authorization boundaries, and review suspicious requests.

Open the original CISA Known Exploited Vulnerabilities record

CVE-2026-14356: The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in…

NIST National Vulnerability Database | July 30, 2026 | HIGH | CVSS 8.8

The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwrite the email address and password of any…

Why it matters: CVE-2026-14356 may sit directly on a public website, so a vulnerable core, plugin, or theme can turn a routine content system into an initial-access path.

What to verify: Record the exact WordPress core and extension versions, confirm whether the affected feature is enabled, review administrator accounts, and inspect web requests before and after the update.