Kwetsbaarheden verholpen in WordPress door Automattic
Two vulnerabilities have been fixed in WordPress Core versions 6.8.6, 6.9.5, and 7.0.2. These vulnerabilities correspond to CVE-2026-60137 and CVE-2026-63030 and involve weaknesses categorized under CWE-89 and CWE-436. No CVSS score is provided for these issues. There are no known exploits in the wild at this time. The vulnerabilities have been addressed by the WordPress development team (Automattic).
AI Analysis
Technical Summary
This advisory reports two security vulnerabilities in WordPress Core affecting versions 6.8.6, 6.9.5, and 7.0.2. The issues correspond to CWE-89 (Injection) and CWE-436 (Improper Handling of Security-relevant Information). The vulnerabilities have been fixed in these specific versions. No CVSS score or detailed technical exploitation information is provided. No known active exploitation has been reported. The fixes are published by the WordPress team and coordinated by the Nationaal Cyber Security Centrum under advisory NCSC-2026-0250.
Potential Impact
The vulnerabilities involve injection and improper handling of security-relevant information, which could potentially allow attackers to manipulate queries or bypass security controls if unpatched. However, no active exploitation is known, and the issues have been fixed in the specified WordPress versions.
Mitigation Recommendations
Update WordPress installations to versions 6.8.6, 6.9.5, or 7.0.2 as applicable to apply the official fixes. Since these versions contain the patches, running earlier versions leaves systems vulnerable. No additional mitigation guidance is provided by the vendor advisory.
Kwetsbaarheden verholpen in WordPress door Automattic
Description
Two vulnerabilities have been fixed in WordPress Core versions 6.8.6, 6.9.5, and 7.0.2. These vulnerabilities correspond to CVE-2026-60137 and CVE-2026-63030 and involve weaknesses categorized under CWE-89 and CWE-436. No CVSS score is provided for these issues. There are no known exploits in the wild at this time. The vulnerabilities have been addressed by the WordPress development team (Automattic).
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory reports two security vulnerabilities in WordPress Core affecting versions 6.8.6, 6.9.5, and 7.0.2. The issues correspond to CWE-89 (Injection) and CWE-436 (Improper Handling of Security-relevant Information). The vulnerabilities have been fixed in these specific versions. No CVSS score or detailed technical exploitation information is provided. No known active exploitation has been reported. The fixes are published by the WordPress team and coordinated by the Nationaal Cyber Security Centrum under advisory NCSC-2026-0250.
Potential Impact
The vulnerabilities involve injection and improper handling of security-relevant information, which could potentially allow attackers to manipulate queries or bypass security controls if unpatched. However, no active exploitation is known, and the issues have been fixed in the specified WordPress versions.
Mitigation Recommendations
Update WordPress installations to versions 6.8.6, 6.9.5, or 7.0.2 as applicable to apply the official fixes. Since these versions contain the patches, running earlier versions leaves systems vulnerable. No additional mitigation guidance is provided by the vendor advisory.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Nationaal Cyber Security Centrum
- Advisory Id
- NCSC-2026-0250
- Cve Count
- 2
- Additional Cves
- ["CVE-2026-63030"]
- Cvss Version
- null
Threat ID: 6a5ba18244ab8fbf7c78a186
Added to database: 07/18/2026, 15:53:38 UTC
Last enriched: 07/18/2026, 16:24:41 UTC
Last updated: 07/18/2026, 16:29:48 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.