{
  "id": "CVE-2026-60137",
  "vendor_project": "WordPress",
  "product": "Core",
  "description": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.",
  "kev_date_added": "2026-07-21",
  "cvss": 9.0,
  "severity": "High",
  "advisories": [],
  "cited_in_cases": [],
  "indictment_cited": false
}