WordPress vulnerabilities in CISA KEV
WordPress has 7 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 38th highest of any vendor. 4 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 14 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Core, with 3 entries. Other frequently affected products: File Manager Plugin (1); Snap Creek Duplicator Plugin (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor wordpress --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
7
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-11-03
most recent entry
┌─ last 12 months
4
entries added
┌─ ransomware use
0 of 7
0% linked to ransomware
┌─ distinct products
5
affected products
$ awk -F, {print $1} /var/log/kev/wordpress.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 3 | 0 |
| 2026 | 4 | 0 |
$ sort /var/log/kev/wordpress.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Core 3 entries
- File Manager Plugin 1 entry
- Snap Creek Duplicator Plugin 1 entry
- Social Warfare Plugin 1 entry
- WordPress Core 1 entry
$ kev-due-dates --vendor wordpress
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ WordPress
14 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/wordpress.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (7 of 7 have at least one CWE).
$ grep -ril 'WordPress' /var/log/news | head -5
Our reporting that names WordPress or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
$ wc -l ./wordpress.kev · 7 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-119977
WordPress Core
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
due 2026-11-06 · CWE-367
$ cat CVE-2026-119977.txt
Description. WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-87902
Core
WordPress Core Remote File Inclusion Vulnerability
due 2026-09-28 · CWE-98
$ cat CVE-2026-87902.txt
Description. WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-60137
Core
WordPress Core SQL Injection Vulnerability
due 2026-08-04 · CWE-89
$ cat CVE-2026-60137.txt
Description. WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2026-63030
Core
WordPress Core Interpretation Conflict Vulnerability
due 2026-07-24 · CWE-436
$ cat CVE-2026-63030.txt
Description. WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
Required action. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- CVE-2019-9978
Social Warfare Plugin
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
due 2022-05-03 · CWE-79
$ cat CVE-2019-9978.txt
Description. WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
Required action. Apply updates per vendor instructions.
- CVE-2020-11738
Snap Creek Duplicator Plugin
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2020-11738.txt
Description. WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
Required action. Apply updates per vendor instructions.
- CVE-2020-25213
File Manager Plugin
WordPress File Manager Plugin Remote Code Execution Vulnerability
due 2022-05-03 · CWE-434
$ cat CVE-2020-25213.txt
Description. WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Required action. Apply updates per vendor instructions.