{"schema_version":"2","view":"grouped","data":[{"id":60363,"cve_ids":["CVE-2026-87902"],"payload":{"kind":"advisory","title":"WordPress Core Remote File Inclusion Vulnerability","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-87902","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-87902","aliases":["CVE-2026-87902"],"affected":[],"modified":"2026-09-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-98"],"cveID":"CVE-2026-87902","notes":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902","dueDate":"2026-09-28","product":"Core","dateAdded":"2026-09-25","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","vulnerabilityName":"WordPress Core Remote File Inclusion Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-87902","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8268e049-0ec0-477c-a03b-19e24cee0cfc","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress-multisite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":3,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","advisory_id":"8268e049-0ec0-477c-a03b-19e24cee0cfc","event_types":["advisory"],"published_at":"2026-10-25T18:32:57.157842+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-25T00:00:00+00:00","detail_url":"/advisories/advisory%3A8268e049-0ec0-477c-a03b-19e24cee0cfc","group":{"id":"advisory:8268e049-0ec0-477c-a03b-19e24cee0cfc","revision":1,"primary_event_id":59566,"change":"published","superseded_by":[],"changed":{"id":59566,"cve_ids":["CVE-2026-87902"],"payload":{"kind":"advisory","title":"WordPress Core Remote File Inclusion Vulnerability","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-87902","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-87902","aliases":["CVE-2026-87902"],"affected":[],"modified":"2026-09-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-98"],"cveID":"CVE-2026-87902","notes":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902","dueDate":"2026-09-28","product":"Core","dateAdded":"2026-09-25","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","vulnerabilityName":"WordPress Core Remote File Inclusion Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-87902","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8268e049-0ec0-477c-a03b-19e24cee0cfc","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress-multisite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":3,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","advisory_id":"8268e049-0ec0-477c-a03b-19e24cee0cfc","event_types":["advisory"],"published_at":"2026-10-25T18:32:57.157842+00:00","technologies":["core","core-kev"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T00:00:00+00:00","detail_url":"/events/59566"},"members":[{"id":59566,"cve_ids":["CVE-2026-87902"],"payload":{"kind":"advisory","title":"WordPress Core Remote File Inclusion Vulnerability","summary":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-87902","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-87902","aliases":["CVE-2026-87902"],"affected":[],"modified":"2026-09-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-98"],"cveID":"CVE-2026-87902","notes":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-7hp8-65ch-5whp ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-87902","dueDate":"2026-09-28","product":"Core","dateAdded":"2026-09-25","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.","vulnerabilityName":"WordPress Core Remote File Inclusion Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-87902","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:8268e049-0ec0-477c-a03b-19e24cee0cfc","priority":{"reasons":["linked_severity","known_exploited"],"severity":"high","linked_cves":[{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"},{"cve":"CVE-2026-87902","metrics":[],"products":[{"name":{"value":"wordpress-multisite","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.1.2","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"high","source_id":"core-osv","source_url":"https://osv.dev/vulnerability/BIT-wordpress-multisite-2026-87902","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":3,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-87902","advisory_id":"8268e049-0ec0-477c-a03b-19e24cee0cfc","event_types":["advisory"],"published_at":"2026-10-25T18:32:57.157842+00:00","technologies":["core","core-kev"],"context_update":true,"extraction_method":"structured","source_published_at":"2026-09-25T00:00:00+00:00","detail_url":"/events/59566"}]}},{"id":2691,"cve_ids":["CVE-2019-6340"],"payload":{"kind":"advisory","title":"Drupal Core Remote Code Execution Vulnerability","summary":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-6340","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-6340","aliases":["CVE-2019-6340"],"affected":[],"modified":"2022-03-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2019-6340","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","dueDate":"2022-04-15","product":"Core","dateAdded":"2022-03-25","vendorProject":"Drupal","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-6340","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:543bb787-ffbc-41af-bb55-8eec7201cdd2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6340","advisory_id":"543bb787-ffbc-41af-bb55-8eec7201cdd2","event_types":["advisory"],"published_at":"2026-10-24T21:23:19.060244+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-25T00:00:00+00:00","detail_url":"/advisories/advisory%3A543bb787-ffbc-41af-bb55-8eec7201cdd2","group":{"id":"advisory:543bb787-ffbc-41af-bb55-8eec7201cdd2","revision":1,"primary_event_id":2700,"change":"published","superseded_by":[],"changed":{"id":2700,"cve_ids":["CVE-2019-6340"],"payload":{"kind":"advisory","title":"Drupal Core Remote Code Execution Vulnerability","summary":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-6340","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-6340","aliases":["CVE-2019-6340"],"affected":[],"modified":"2022-03-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2019-6340","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","dueDate":"2022-04-15","product":"Core","dateAdded":"2022-03-25","vendorProject":"Drupal","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-6340","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:543bb787-ffbc-41af-bb55-8eec7201cdd2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6340","advisory_id":"543bb787-ffbc-41af-bb55-8eec7201cdd2","event_types":["advisory"],"published_at":"2026-10-24T21:23:19.060244+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-25T00:00:00+00:00","detail_url":"/events/2700"},"members":[{"id":2700,"cve_ids":["CVE-2019-6340"],"payload":{"kind":"advisory","title":"Drupal Core Remote Code Execution Vulnerability","summary":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2019-6340","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2019-6340","aliases":["CVE-2019-6340"],"affected":[],"modified":"2022-03-25T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-502"],"cveID":"CVE-2019-6340","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-6340","dueDate":"2022-04-15","product":"Core","dateAdded":"2022-03-25","vendorProject":"Drupal","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"In Drupal Core, some field types do not properly sanitize data from non-form sources. This can lead to arbitrary PHP code execution in some cases.","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2019-6340","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:543bb787-ffbc-41af-bb55-8eec7201cdd2","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-6340","advisory_id":"543bb787-ffbc-41af-bb55-8eec7201cdd2","event_types":["advisory"],"published_at":"2026-10-24T21:23:19.060244+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-03-25T00:00:00+00:00","detail_url":"/events/2700"}]}},{"id":2616,"cve_ids":["CVE-2018-7602"],"payload":{"kind":"advisory","title":"Drupal Core Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-7602","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7602","aliases":["CVE-2018-7602"],"affected":[],"modified":"2022-04-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2018-7602","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","dueDate":"2022-05-04","product":"Core","dateAdded":"2022-04-13","vendorProject":"Drupal","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2018-7602","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7602","advisory_id":"542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","event_types":["advisory"],"published_at":"2026-10-24T21:21:53.686423+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-04-13T00:00:00+00:00","detail_url":"/advisories/advisory%3A542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","group":{"id":"advisory:542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","revision":1,"primary_event_id":2626,"change":"published","superseded_by":[],"changed":{"id":2626,"cve_ids":["CVE-2018-7602"],"payload":{"kind":"advisory","title":"Drupal Core Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-7602","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7602","aliases":["CVE-2018-7602"],"affected":[],"modified":"2022-04-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2018-7602","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","dueDate":"2022-05-04","product":"Core","dateAdded":"2022-04-13","vendorProject":"Drupal","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2018-7602","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7602","advisory_id":"542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","event_types":["advisory"],"published_at":"2026-10-24T21:21:53.686423+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-04-13T00:00:00+00:00","detail_url":"/events/2626"},"members":[{"id":2626,"cve_ids":["CVE-2018-7602"],"payload":{"kind":"advisory","title":"Drupal Core Remote Code Execution Vulnerability","summary":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site. CISA required action: Apply updates per vendor instructions.","evidence":"kev:CVE-2018-7602","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2018-7602","aliases":["CVE-2018-7602"],"affected":[],"modified":"2022-04-13T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":[],"cveID":"CVE-2018-7602","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-7602","dueDate":"2022-05-04","product":"Core","dateAdded":"2022-04-13","vendorProject":"Drupal","requiredAction":"Apply updates per vendor instructions.","known_exploited":true,"shortDescription":"A remote code execution vulnerability exists within multiple subsystems of Drupal that can allow attackers to exploit multiple attack vectors on a Drupal site.","vulnerabilityName":"Drupal Core Remote Code Execution Vulnerability","knownRansomwareCampaignUse":"Known"}},"related_cves":[{"value":"CVE-2018-7602","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","priority":{"reasons":["known_exploited"],"severity":"unknown","linked_cves":[],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-7602","advisory_id":"542dd7b5-739b-44b3-bbb2-6ad45a8d1b09","event_types":["advisory"],"published_at":"2026-10-24T21:21:53.686423+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2022-04-13T00:00:00+00:00","detail_url":"/events/2626"}]}},{"id":157,"cve_ids":["CVE-2026-9082"],"payload":{"kind":"advisory","title":"Drupal Core SQL Injection Vulnerability","summary":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2026-9082","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-9082","aliases":["CVE-2026-9082"],"affected":[],"modified":"2026-05-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2026-9082","notes":"https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082","dueDate":"2026-05-27","product":"Core","dateAdded":"2026-05-22","vendorProject":"Drupal","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","vulnerabilityName":"Drupal Core SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-9082","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-9082","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"Drupal core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-9082","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9082","advisory_id":"e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","event_types":["advisory"],"published_at":"2026-10-24T20:41:45.659691+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-22T00:00:00+00:00","detail_url":"/advisories/advisory%3Ae40c3de2-6d68-4ac3-9f01-e7a541ff3e62","group":{"id":"advisory:e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","revision":1,"primary_event_id":155,"change":"published","superseded_by":[],"changed":{"id":155,"cve_ids":["CVE-2026-9082"],"payload":{"kind":"advisory","title":"Drupal Core SQL Injection Vulnerability","summary":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2026-9082","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-9082","aliases":["CVE-2026-9082"],"affected":[],"modified":"2026-05-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2026-9082","notes":"https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082","dueDate":"2026-05-27","product":"Core","dateAdded":"2026-05-22","vendorProject":"Drupal","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","vulnerabilityName":"Drupal Core SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-9082","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-9082","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"Drupal core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-9082","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9082","advisory_id":"e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","event_types":["advisory"],"published_at":"2026-10-24T20:41:45.659691+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-22T00:00:00+00:00","detail_url":"/events/155"},"members":[{"id":155,"cve_ids":["CVE-2026-9082"],"payload":{"kind":"advisory","title":"Drupal Core SQL Injection Vulnerability","summary":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","evidence":"kev:CVE-2026-9082","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-9082","aliases":["CVE-2026-9082"],"affected":[],"modified":"2026-05-22T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2026-9082","notes":"https://www.drupal.org/sa-core-2026-004 ; https://nvd.nist.gov/vuln/detail/CVE-2026-9082","dueDate":"2026-05-27","product":"Core","dateAdded":"2026-05-22","vendorProject":"Drupal","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_exploited":true,"shortDescription":"Drupal Core contains a SQL injection vulnerability that could allow for privilege escalation and remote code execution via specially crafted requests sent with the database abstraction API.","vulnerabilityName":"Drupal Core SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-9082","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-9082","metrics":[{"format":"CVSS","cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"products":[{"name":{"value":"Drupal core","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-9082","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9082","advisory_id":"e40c3de2-6d68-4ac3-9f01-e7a541ff3e62","event_types":["advisory"],"published_at":"2026-10-24T20:41:45.659691+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-05-22T00:00:00+00:00","detail_url":"/events/155"}]}},{"id":109,"cve_ids":["CVE-2026-63030"],"payload":{"kind":"advisory","title":"WordPress Core Interpretation Conflict Vulnerability","summary":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-63030","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-63030","aliases":["CVE-2026-63030"],"affected":[],"modified":"2026-07-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-436"],"cveID":"CVE-2026-63030","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","dueDate":"2026-07-24","product":"Core","dateAdded":"2026-07-21","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","vulnerabilityName":"WordPress Core Interpretation Conflict Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-63030","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5ba722c3-a5de-45e9-b706-f27aa254653c","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-63030","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030","advisory_id":"5ba722c3-a5de-45e9-b706-f27aa254653c","event_types":["advisory"],"published_at":"2026-10-24T20:40:30.685014+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A5ba722c3-a5de-45e9-b706-f27aa254653c","group":{"id":"advisory:5ba722c3-a5de-45e9-b706-f27aa254653c","revision":1,"primary_event_id":107,"change":"published","superseded_by":[],"changed":{"id":107,"cve_ids":["CVE-2026-63030"],"payload":{"kind":"advisory","title":"WordPress Core Interpretation Conflict Vulnerability","summary":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-63030","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-63030","aliases":["CVE-2026-63030"],"affected":[],"modified":"2026-07-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-436"],"cveID":"CVE-2026-63030","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","dueDate":"2026-07-24","product":"Core","dateAdded":"2026-07-21","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","vulnerabilityName":"WordPress Core Interpretation Conflict Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-63030","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5ba722c3-a5de-45e9-b706-f27aa254653c","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-63030","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030","advisory_id":"5ba722c3-a5de-45e9-b706-f27aa254653c","event_types":["advisory"],"published_at":"2026-10-24T20:40:30.685014+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-21T00:00:00+00:00","detail_url":"/events/107"},"members":[{"id":107,"cve_ids":["CVE-2026-63030"],"payload":{"kind":"advisory","title":"WordPress Core Interpretation Conflict Vulnerability","summary":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-63030","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-63030","aliases":["CVE-2026-63030"],"affected":[],"modified":"2026-07-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-436"],"cveID":"CVE-2026-63030","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030","dueDate":"2026-07-24","product":"Core","dateAdded":"2026-07-21","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.","vulnerabilityName":"WordPress Core Interpretation Conflict Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-63030","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5ba722c3-a5de-45e9-b706-f27aa254653c","priority":{"reasons":["linked_severity","known_exploited"],"severity":"critical","linked_cves":[{"cve":"CVE-2026-63030","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":9.8,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}],"products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"critical","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-63030","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-63030","advisory_id":"5ba722c3-a5de-45e9-b706-f27aa254653c","event_types":["advisory"],"published_at":"2026-10-24T20:40:30.685014+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-21T00:00:00+00:00","detail_url":"/events/107"}]}},{"id":108,"cve_ids":["CVE-2026-60137"],"payload":{"kind":"advisory","title":"WordPress Core SQL Injection Vulnerability","summary":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-60137","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-60137","aliases":["CVE-2026-60137"],"affected":[],"modified":"2026-07-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2026-60137","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137","dueDate":"2026-08-04","product":"Core","dateAdded":"2026-07-21","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","vulnerabilityName":"WordPress Core SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-60137","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1601b8fa-d157-4495-96bc-80a0b58b3cf1","priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-60137","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137","advisory_id":"1601b8fa-d157-4495-96bc-80a0b58b3cf1","event_types":["advisory"],"published_at":"2026-10-24T20:40:30.104598+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-21T00:00:00+00:00","detail_url":"/advisories/advisory%3A1601b8fa-d157-4495-96bc-80a0b58b3cf1","group":{"id":"advisory:1601b8fa-d157-4495-96bc-80a0b58b3cf1","revision":1,"primary_event_id":106,"change":"published","superseded_by":[],"changed":{"id":106,"cve_ids":["CVE-2026-60137"],"payload":{"kind":"advisory","title":"WordPress Core SQL Injection Vulnerability","summary":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-60137","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-60137","aliases":["CVE-2026-60137"],"affected":[],"modified":"2026-07-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2026-60137","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137","dueDate":"2026-08-04","product":"Core","dateAdded":"2026-07-21","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","vulnerabilityName":"WordPress Core SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-60137","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1601b8fa-d157-4495-96bc-80a0b58b3cf1","priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-60137","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137","advisory_id":"1601b8fa-d157-4495-96bc-80a0b58b3cf1","event_types":["advisory"],"published_at":"2026-10-24T20:40:30.104598+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-21T00:00:00+00:00","detail_url":"/events/106"},"members":[{"id":106,"cve_ids":["CVE-2026-60137"],"payload":{"kind":"advisory","title":"WordPress Core SQL Injection Vulnerability","summary":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","evidence":"kev:CVE-2026-60137","products":[{"name":{"value":"Core","evidence":"/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2026-60137","aliases":["CVE-2026-60137"],"affected":[],"modified":"2026-07-21T00:00:00.000Z","provider":"kev","references":["https://www.cisa.gov/known-exploited-vulnerabilities-catalog"],"exploitation":{"cwes":["CWE-89"],"cveID":"CVE-2026-60137","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137","dueDate":"2026-08-04","product":"Core","dateAdded":"2026-07-21","vendorProject":"WordPress","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_exploited":true,"shortDescription":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","vulnerabilityName":"WordPress Core SQL Injection Vulnerability","knownRansomwareCampaignUse":"Unknown"}},"related_cves":[{"value":"CVE-2026-60137","evidence":"/cveID"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:1601b8fa-d157-4495-96bc-80a0b58b3cf1","priority":{"reasons":["known_exploited"],"severity":"medium","linked_cves":[{"cve":"CVE-2026-60137","metrics":[{"cvssV3_1":{"version":"3.1","baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}],"products":[{"name":{"value":"WordPress","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","relationship":"advisory","known_exploited":false,"relationship_evidence":"/cveID"}],"fix_available":false,"known_exploited":true,"publisher_severity":"unknown"},"revision":1,"source_id":"core-kev","source_url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-60137","advisory_id":"1601b8fa-d157-4495-96bc-80a0b58b3cf1","event_types":["advisory"],"published_at":"2026-10-24T20:40:30.104598+00:00","technologies":["core","core-kev"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-21T00:00:00+00:00","detail_url":"/events/106"}]}}],"next_after":60363,"next_before":108}