WordPress security advisory (AV26-723)

[MalBot]

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

  <div>
<div>

        <div><p><strong>Serial number:</strong> AV26-723<br /><strong>Date:</strong> July&nbsp;20, 2026</p>

On July 17, 2026, WordPress published a security advisory to address vulnerabilities in the following product:

• WordPress 7.0 – versions prior to 7.0.2
• WordPress 6.9 – versions prior to 6.9.5
• WordPress 6.8 – versions prior to 6.8.6
• WordPress 7.1 beta – versions prior to 7.1 beta2

Open-source reporting indicates that CVE-2026-60137 and CVE-2026-63030 are being exploited in the wild.

The Cyber Centre encourages users and administrators to review the provided web links and apply the necessary updates.

• Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`
• REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
• WordPress 7.0.2 Release
• WordPress Releases

</div>

Article Link: WordPress security advisory (AV26-723) - Canadian Centre for Cyber Security