certfr_avis - certfr-2026-avi-0904

CERTFR-2026-AVI-0904

Vulnerability from certfr_avis

De multiples vulnérabilités ont été découvertes dans WordPress. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une injection SQL (SQLi) et un contournement de la politique de sécurité.

Le CERT-FR a connaissance d'une preuve de concept publique.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur précise que les versions 6.9.x et ultérieures sont affectées par les deux vulnérabilités, dont l'exploitation combinée permet à un attaquant, non authentifié, une exécution de code arbitraire à distance.

Impacted products

Vendor	Product	Description
WordPress	WordPress	WordPress versions 6.8.x antérieures à 6.8.6
WordPress	WordPress	WordPress versions 7.1.x antérieures à 7.1 beta2
WordPress	WordPress	WordPress versions 7.x antérieures à 7.0.2
WordPress	WordPress	WordPress versions 6.9.x antérieures à 6.9.5

References

Title

Publication Time

Tags

Bulletin de sécurité WordPress wordpress-7-0-2

2026-07-17

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "WordPress versions 6.8.x ant\u00e9rieures \u00e0 6.8.6",
      "product": {
        "name": "WordPress",
        "vendor": {
          "name": "WordPress",
          "scada": false
        }
      }
    },
    {
      "description": "WordPress versions 7.1.x ant\u00e9rieures \u00e0 7.1 beta2",
      "product": {
        "name": "WordPress",
        "vendor": {
          "name": "WordPress",
          "scada": false
        }
      }
    },
    {
      "description": "WordPress versions 7.x ant\u00e9rieures \u00e0 7.0.2",
      "product": {
        "name": "WordPress",
        "vendor": {
          "name": "WordPress",
          "scada": false
        }
      }
    },
    {
      "description": "WordPress versions 6.9.x ant\u00e9rieures \u00e0 6.9.5",
      "product": {
        "name": "WordPress",
        "vendor": {
          "name": "WordPress",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur pr\u00e9cise que les versions 6.9.x et ult\u00e9rieures sont affect\u00e9es par les deux vuln\u00e9rabilit\u00e9s, dont l\u0027exploitation combin\u00e9e permet \u00e0 un attaquant, non authentifi\u00e9, une ex\u00e9cution de code arbitraire \u00e0 distance. ",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-60137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-60137"
    },
    {
      "name": "CVE-2026-63030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-63030"
    }
  ],
  "initial_release_date": "2026-07-20T00:00:00",
  "last_revision_date": "2026-07-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0904",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans WordPress. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une injection SQL (SQLi) et un contournement de la politique de s\u00e9curit\u00e9.\n\nLe CERT-FR a connaissance d\u0027une preuve de concept publique.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans WordPress",
  "vendor_advisories": [
    {
      "published_at": "2026-07-17",
      "title": "Bulletin de s\u00e9curit\u00e9 WordPress wordpress-7-0-2",
      "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"
    }
  ]
}

CVE-2026-63030 (GCVE-0-2026-63030)

Vulnerability from cvelistv5

Published

2026-07-17 19:14

Modified

2026-07-22 03:55

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-436 Interpretation Conflict

Summary

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.

References

URL

Tags

	https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q	vdb-entry, technical-description
	https://wordpress.org/news/2026/07/wordpress-7-0-2-release/	release-notes, vendor-advisory

Impacted products

	Vendor	Product	Version
	WordPress	WordPress	Version: 6.9.0 ≤ Version: 7.0.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-63030",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-21T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-07-21",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-436",
                "description": "CWE-436 Interpretation Conflict",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-22T03:55:46.565Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-07-21T00:00:00.000Z",
            "value": "CVE-2026-63030 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WordPress",
          "vendor": "WordPress",
          "versions": [
            {
              "lessThan": "6.9.5",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.2",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Adam Kues, Assetnote / Searchlight Cyber"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WordPress Security Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T04:13:49.898Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q"
        },
        {
          "tags": [
            "release-notes",
            "vendor-advisory"
          ],
          "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress \u003c 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-63030",
    "datePublished": "2026-07-17T19:14:12.910Z",
    "dateReserved": "2026-07-17T17:17:24.474Z",
    "dateUpdated": "2026-07-22T03:55:46.565Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-60137 (GCVE-0-2026-60137)

Vulnerability from cvelistv5

Published

2026-07-17 19:14

Modified

2026-07-29 19:26

Severity ?

5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 SQL Injection

Summary

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

References

URL

Tags

	https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf	vdb-entry, technical-description
	https://wordpress.org/news/2026/07/wordpress-7-0-2-release/	release-notes, vendor-advisory

Impacted products

	Vendor	Product	Version
	WordPress	WordPress	Version: 6.8.0 ≤ Version: 6.9.0 ≤ Version: 7.0.0 ≤

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-60137",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-22T03:55:47.898130Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-07-21",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-89",
                "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T19:26:43.785Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-07-21T00:00:00.000Z",
            "value": "CVE-2026-60137 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WordPress",
          "vendor": "WordPress",
          "versions": [
            {
              "lessThan": "6.8.6",
              "status": "affected",
              "version": "6.8.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.9.5",
              "status": "affected",
              "version": "6.9.0",
              "versionType": "semver"
            },
            {
              "lessThan": "7.0.2",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "TF1T"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "dtro"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "haongo"
        },
        {
          "lang": "en",
          "type": "coordinator",
          "value": "WordPress Security Team"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-18T04:13:49.003Z",
        "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
        "shortName": "WPScan"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "technical-description"
          ],
          "url": "https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf"
        },
        {
          "tags": [
            "release-notes",
            "vendor-advisory"
          ],
          "url": "https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "WordPress \u003c 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query",
      "x_generator": {
        "engine": "WPScan CVE Generator"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
    "assignerShortName": "WPScan",
    "cveId": "CVE-2026-60137",
    "datePublished": "2026-07-17T19:14:12.159Z",
    "dateReserved": "2026-07-17T17:17:24.479Z",
    "dateUpdated": "2026-07-29T19:26:43.785Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2026-AVI-0904

Vulnerability from certfr_avis

Solutions

CVE-2026-63030 (GCVE-0-2026-63030)

Vulnerability from cvelistv5

CVE-2026-60137 (GCVE-0-2026-60137)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature