{"schema_version":1,"title":"Wordpress vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 17 vulnerabilities in Wordpress: 1 in the last 7 days and 3 in the last 90 days, 4 of them critical and 3 exploited in the wild. The most recent, CVE-2026-87902, was published on 22 September 2026.","url":"https://junglewise.ai/threats/technologies/wordpress","json_url":"https://junglewise.ai/threats/technologies/wordpress.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/wordpress","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":17,"critical":4,"exploited":3,"last_7_days":1,"last_30_days":1,"last_90_days":3,"last_365_days":3},"latest":[{"cve":"CVE-2026-87902","cvss":8.1,"epss":0.0288,"slug":"cve-2026-87902-wordpress-core-remote-file-inclusion","title":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the","severity":"critical","exploited":true,"published_at":"2026-09-22T17:17:28.31+00:00","url":"https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion"},{"cve":"CVE-2026-63030","cvss":7.5,"epss":0.0895,"slug":"cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to","title":"WordPress REST API route confusion and SQL injection leading to RCE","severity":"critical","exploited":true,"published_at":"2026-07-17T20:17:28.49+00:00","url":"https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to"},{"cve":"CVE-2026-60137","cvss":9.1,"epss":0.0403,"slug":"cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter","title":"WordPress SQL injection in WP_Query author__not_in parameter","severity":"critical","exploited":true,"published_at":"2026-07-17T20:17:27.79+00:00","url":"https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter"},{"cve":"CVE-2016-4567","cvss":3,"slug":"cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component","title":"MediaElement.js Reflected XSS in FlashMediaElement component","severity":"low","exploited":false,"published_at":"2022-05-17T03:35:09+00:00","url":"https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component"},{"cve":"CVE-2017-5612","cvss":6.1,"slug":"cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt","title":"WordPress XSS in posts list table excerpt","severity":"medium","exploited":false,"published_at":"2017-01-30T04:59:00.64+00:00","url":"https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt"},{"cve":"CVE-2017-5611","cvss":9.8,"slug":"cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling","title":"WordPress WP_Query SQL injection in post type handling","severity":"critical","exploited":false,"published_at":"2017-01-30T04:59:00.61+00:00","url":"https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling"},{"cve":"CVE-2017-5610","cvss":5.3,"slug":"cve-2017-5610-wordpress-press-this-information-exposure-in-taxonomy-ui","title":"WordPress Press This information exposure in taxonomy UI","severity":"medium","exploited":false,"published_at":"2017-01-30T04:59:00.563+00:00","url":"https://junglewise.ai/threats/cve-2017-5610-wordpress-press-this-information-exposure-in-taxonomy-ui"},{"cve":"CVE-2016-6897","cvss":6.5,"slug":"cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin","title":"WordPress CSRF and Path Traversal in wp_ajax_update_plugin","severity":"medium","exploited":false,"published_at":"2017-01-18T21:59:00.307+00:00","url":"https://junglewise.ai/threats/cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin"},{"cve":"CVE-2016-6896","cvss":7.1,"slug":"cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin","title":"WordPress directory traversal in wp_ajax_update_plugin","severity":"high","exploited":false,"published_at":"2017-01-18T21:59:00.277+00:00","url":"https://junglewise.ai/threats/cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin"},{"cve":"CVE-2016-10148","cvss":4.3,"slug":"cve-2016-10148-wordpress-improper-access-control-in-wp-ajax-update-plugin","title":"WordPress improper access control in wp_ajax_update_plugin","severity":"medium","exploited":false,"published_at":"2017-01-18T21:59:00.247+00:00","url":"https://junglewise.ai/threats/cve-2016-10148-wordpress-improper-access-control-in-wp-ajax-update-plugin"},{"cve":"CVE-2017-5493","cvss":7.5,"slug":"cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation","title":"WordPress Multisite weak random number generation in activation keys","severity":"high","exploited":false,"published_at":"2017-01-15T02:59:03.077+00:00","url":"https://junglewise.ai/threats/cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation"},{"cve":"CVE-2017-5492","cvss":8.8,"slug":"cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode","title":"WordPress CSRF in widget-editing accessibility mode","severity":"high","exploited":false,"published_at":"2017-01-15T02:59:03.033+00:00","url":"https://junglewise.ai/threats/cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode"},{"cve":"CVE-2017-5491","cvss":5.3,"slug":"cve-2017-5491-wordpress-bypass-of-posting-restrictions-in-wp-mail-php","title":"WordPress bypass of posting restrictions in wp-mail.php","severity":"medium","exploited":false,"published_at":"2017-01-15T02:59:02.987+00:00","url":"https://junglewise.ai/threats/cve-2017-5491-wordpress-bypass-of-posting-restrictions-in-wp-mail-php"},{"cve":"CVE-2017-5490","cvss":6.1,"slug":"cve-2017-5490-wordpress-xss-in-theme-name-fallback-functionality","title":"WordPress XSS in theme-name fallback functionality","severity":"medium","exploited":false,"published_at":"2017-01-15T02:59:02.937+00:00","url":"https://junglewise.ai/threats/cve-2017-5490-wordpress-xss-in-theme-name-fallback-functionality"},{"cve":"CVE-2017-5489","cvss":8.8,"slug":"cve-2017-5489-wordpress-csrf-bypass-via-flash-file-upload","title":"WordPress CSRF bypass via Flash file upload","severity":"high","exploited":false,"published_at":"2017-01-15T02:59:02.89+00:00","url":"https://junglewise.ai/threats/cve-2017-5489-wordpress-csrf-bypass-via-flash-file-upload"},{"cve":"CVE-2017-5488","cvss":6.1,"slug":"cve-2017-5488-wordpress-xss-in-update-core-php-via-plugin-headers","title":"WordPress XSS in update-core.php via plugin headers","severity":"medium","exploited":false,"published_at":"2017-01-15T02:59:02.86+00:00","url":"https://junglewise.ai/threats/cve-2017-5488-wordpress-xss-in-update-core-php-via-plugin-headers"},{"cve":"CVE-2017-5487","cvss":5.3,"slug":"cve-2017-5487-wordpress-rest-api-information-disclosure-in-users-controller","title":"WordPress REST API information disclosure in users controller","severity":"medium","exploited":false,"published_at":"2017-01-15T02:59:02.797+00:00","url":"https://junglewise.ai/threats/cve-2017-5487-wordpress-rest-api-information-disclosure-in-users-controller"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":2,"exploited":2,"vulnerabilities":2},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":1,"exploited":1,"vulnerabilities":1}],"related":[{"name":"Wordpress Advanced Customized Prompts","slug":"advanced-customized-prompts","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/advanced-customized-prompts"},{"name":"Wordpress Filter Gallery","slug":"filter-gallery","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/filter-gallery"},{"name":"Wordpress Login & Register Forms","slug":"login-register-forms","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/login-register-forms"},{"name":"Wordpress User Access Manager","slug":"user-access-manager","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/user-access-manager"}],"technology":{"hub":true,"name":"Wordpress","slug":"wordpress","vendor":{"name":"Wordpress","slug":"wordpress","url":"https://junglewise.ai/threats/vendors/wordpress"},"aliases":["wordpress-core"],"category":"cms","homepage":"https://wordpress.org/","repo_url":"https://github.com/WordPress/WordPress","description":"WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database.","url":"https://junglewise.ai/threats/technologies/wordpress"},"most_severe":[{"cve":"CVE-2026-60137","cvss":9.1,"epss":0.0403,"slug":"cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter","title":"WordPress SQL injection in WP_Query author__not_in parameter","severity":"critical","exploited":true,"published_at":"2026-07-17T20:17:27.79+00:00","url":"https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter"},{"cve":"CVE-2026-87902","cvss":8.1,"epss":0.0288,"slug":"cve-2026-87902-wordpress-core-remote-file-inclusion","title":"An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the","severity":"critical","exploited":true,"published_at":"2026-09-22T17:17:28.31+00:00","url":"https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion"},{"cve":"CVE-2026-63030","cvss":7.5,"epss":0.0895,"slug":"cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to","title":"WordPress REST API route confusion and SQL injection leading to RCE","severity":"critical","exploited":true,"published_at":"2026-07-17T20:17:28.49+00:00","url":"https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to"},{"cve":"CVE-2017-5611","cvss":9.8,"slug":"cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling","title":"WordPress WP_Query SQL injection in post type handling","severity":"critical","exploited":false,"published_at":"2017-01-30T04:59:00.61+00:00","url":"https://junglewise.ai/threats/cve-2017-5611-wordpress-wp-query-sql-injection-in-post-type-handling"},{"cve":"CVE-2017-5492","cvss":8.8,"slug":"cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode","title":"WordPress CSRF in widget-editing accessibility mode","severity":"high","exploited":false,"published_at":"2017-01-15T02:59:03.033+00:00","url":"https://junglewise.ai/threats/cve-2017-5492-wordpress-csrf-in-widget-editing-accessibility-mode"},{"cve":"CVE-2017-5489","cvss":8.8,"slug":"cve-2017-5489-wordpress-csrf-bypass-via-flash-file-upload","title":"WordPress CSRF bypass via Flash file upload","severity":"high","exploited":false,"published_at":"2017-01-15T02:59:02.89+00:00","url":"https://junglewise.ai/threats/cve-2017-5489-wordpress-csrf-bypass-via-flash-file-upload"},{"cve":"CVE-2017-5493","cvss":7.5,"slug":"cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation","title":"WordPress Multisite weak random number generation in activation keys","severity":"high","exploited":false,"published_at":"2017-01-15T02:59:03.077+00:00","url":"https://junglewise.ai/threats/cve-2017-5493-wordpress-multisite-weak-random-number-generation-in-activation"},{"cve":"CVE-2016-6896","cvss":7.1,"slug":"cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin","title":"WordPress directory traversal in wp_ajax_update_plugin","severity":"high","exploited":false,"published_at":"2017-01-18T21:59:00.277+00:00","url":"https://junglewise.ai/threats/cve-2016-6896-wordpress-directory-traversal-in-wp-ajax-update-plugin"},{"cve":"CVE-2016-6897","cvss":6.5,"slug":"cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin","title":"WordPress CSRF and Path Traversal in wp_ajax_update_plugin","severity":"medium","exploited":false,"published_at":"2017-01-18T21:59:00.307+00:00","url":"https://junglewise.ai/threats/cve-2016-6897-wordpress-csrf-and-path-traversal-in-wp-ajax-update-plugin"},{"cve":"CVE-2017-5612","cvss":6.1,"slug":"cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt","title":"WordPress XSS in posts list table excerpt","severity":"medium","exploited":false,"published_at":"2017-01-30T04:59:00.64+00:00","url":"https://junglewise.ai/threats/cve-2017-5612-wordpress-xss-in-posts-list-table-excerpt"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}