# WordPress vulnerabilities & exploitation

**CISA KEV**

> As of 2026-11-07, Threadlinqs tracks 5 WordPress CVEs, 1 in the CISA Known Exploited Vulnerabilities catalog, linked to 46 tracked threat campaigns and 12 named threat actors.

**Data as of:** 2026-11-07

## Exploitation timeline

Threadlinqs has recorded 5 WordPress CVEs published between 2026-07-15 and 2026-09-15. The busiest month was 2026-07 (2 new CVEs). 1 of them (20%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

## Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked WordPress CVEs.

- [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030) — CRITICAL 9.8 · KEV · EPSS 38.6% · 2026-07-17
- [CVE-2026-65640](https://intel.threadlinqs.com/cve/CVE-2026-65640) — HIGH 8.8 · EPSS 1.9% · 2026-08-17
- [CVE-2026-64638](https://intel.threadlinqs.com/cve/CVE-2026-64638) — HIGH 8.9 · 2026-08-07
- [CVE-2026-87902](https://intel.threadlinqs.com/cve/CVE-2026-87902) — HIGH 8.1 · 2026-09-22
- [CVE-2026-60137](https://intel.threadlinqs.com/cve/CVE-2026-60137) — MEDIUM 5.9 · 2026-07-17

## Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 1 distinct WordPress product is affected. The most frequently affected:

- WordPress — 5 CVEs

## Threat activity

46 tracked threat campaigns reference WordPress products or exploit WordPress CVEs; the 25 most recent are listed.

- [Active Exploitation of WordPress Core Unauthenticated Upgrade-Window RCE (Versions 4.7 through 7.1.3) Hours After 7.1.4 Patch Release](https://intel.threadlinqs.com/threat/TL-2026-4804) — CRITICAL — 2026-10-30
- [WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSS](https://intel.threadlinqs.com/threat/TL-2026-4707) — HIGH — 2026-10-29
- [WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE (Core Update Race Condition)](https://intel.threadlinqs.com/threat/TL-2026-4696) — HIGH — 2026-10-29
- [EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data Channel C2](https://intel.threadlinqs.com/threat/TL-2026-4510) — HIGH — 2026-10-27
- [TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to Silently Install PHP Backdoor via Fake 'Web Media Optimizer' Plugin](https://intel.threadlinqs.com/threat/TL-2026-4505) — HIGH — 2026-10-27
- [BUGSTER: Low-Skill Financially Motivated Actor Uses AI Agents (Hermes Agent/DeepSeek V4, Cursor IDE) to Plan and Execute Multiple Cybercrime Operations](https://intel.threadlinqs.com/threat/TL-2026-4098) — MEDIUM — 2026-10-22
- [ClearFake Uses Smart Contracts on BNB Smart Chain Testnet for C&C (EtherHiding) to Deliver SectopRAT and ACRStealer](https://intel.threadlinqs.com/threat/TL-2026-3919) — HIGH — 2026-10-19
- [QuoIntelligence Weekly Snapshot W34 2026: AmnesiaStealer (macOS), ErrTraffic MaaS, Malicious RubyGems Packages (StubMaker), Ransom Busters](https://intel.threadlinqs.com/threat/TL-2026-3618) — MEDIUM — 2026-10-15
- [September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitation](https://intel.threadlinqs.com/threat/TL-2026-3448) — CRITICAL — 2026-10-14
- [Critical Ghostscript Heap Buffer Overflow in JPEG 2000 Output Adapter Enables RCE via Malicious PDFs (CVE-2026-39919)](https://intel.threadlinqs.com/threat/TL-2026-3398) — CRITICAL — 2026-10-13
- [WordPress 7.1.3 Security Release: Seven Fixes Including Stored XSS, Second-Order SQL Injection and Unauthenticated Comment Disclosure](https://intel.threadlinqs.com/threat/TL-2026-3259) — MEDIUM — 2026-10-10
- [CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce Platforms](https://intel.threadlinqs.com/threat/TL-2026-2992) — HIGH — 2026-10-07
- [Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers via ImageMagick/libheif (GHSA-x8r2-mggj-j6wr)](https://intel.threadlinqs.com/threat/TL-2026-2938) — CRITICAL — 2026-10-05
- [TIKTOUK Toolkit Harvests AWS, SMTP and Database Credentials from Exposed WordPress Backups and Config Files (CVE-2026-60137, CVE-2026-63030)](https://intel.threadlinqs.com/threat/TL-2026-2889) — HIGH — 2026-10-04
- [Milk Dragon (NaiLong) Phishing-as-a-Service Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFA](https://intel.threadlinqs.com/threat/TL-2026-2919) — HIGH — 2026-10-04
- [CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)](https://intel.threadlinqs.com/threat/TL-2026-2623) — CRITICAL — 2026-09-22
- [Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti UniFi OS Flaws to Steal Government Data](https://intel.threadlinqs.com/threat/TL-2026-2619) — CRITICAL — 2026-09-22
- [Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme Install](https://intel.threadlinqs.com/threat/TL-2026-2597) — CRITICAL — 2026-09-21
- [ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a .NET Stealer](https://intel.threadlinqs.com/threat/TL-2026-2589) — HIGH — 2026-09-20
- [Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious Link](https://intel.threadlinqs.com/threat/TL-2026-2587) — CRITICAL — 2026-09-19
- [Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 Channel](https://intel.threadlinqs.com/threat/TL-2026-2311) — HIGH — 2026-09-03
- [ClickFix Cluster Uses DLL Sideloading and Compromised WordPress Sites to Deliver Lorem Ipsum Loader, Linked to Vanilla Tempest](https://intel.threadlinqs.com/threat/TL-2026-2199) — HIGH — 2026-08-29
- [Hundreds of WordPress Sites Hijacked via Malicious Plugins to Deploy Amatera Stealer through EtherHiding and ClickFix](https://intel.threadlinqs.com/threat/TL-2026-2214) — HIGH — 2026-08-29
- [AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI Coding Agents](https://intel.threadlinqs.com/threat/TL-2026-2070) — CRITICAL — 2026-08-19
- [StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm Payloads](https://intel.threadlinqs.com/threat/TL-2026-2057) — HIGH — 2026-08-18

## Threat actors targeting WordPress

Named threat actors attributed to campaigns that involve WordPress products or CVEs, with the number of linked campaigns:

- [KongTuke](https://intel.threadlinqs.com/actor/KongTuke) — 3 campaigns
- [APT38](https://intel.threadlinqs.com/actor/APT38) — 2 campaigns
- [GrayBravo](https://intel.threadlinqs.com/actor/GrayBravo) — 2 campaigns
- [MuddyWater](https://intel.threadlinqs.com/actor/MuddyWater) — 2 campaigns
- [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1 campaign
- [APT28](https://intel.threadlinqs.com/actor/APT28) — 1 campaign
- [APT43](https://intel.threadlinqs.com/actor/APT43) — 1 campaign
- [DarkSpectre](https://intel.threadlinqs.com/actor/DarkSpectre) — 1 campaign
- [DriveSurge](https://intel.threadlinqs.com/actor/DriveSurge) — 1 campaign
- [Kapibala](https://intel.threadlinqs.com/actor/Kapibala) — 1 campaign
- [Kimsuky](https://intel.threadlinqs.com/actor/Kimsuky) — 1 campaign
- [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1 campaign

## How to prioritise WordPress patching

This order follows the data Threadlinqs holds for WordPress, not a generic severity checklist:

- 1 of 5 WordPress CVEs (20%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-63030](https://intel.threadlinqs.com/cve/CVE-2026-63030).
- Outside KEV, the highest EPSS scores are [CVE-2026-65640](https://intel.threadlinqs.com/cve/CVE-2026-65640) (1.9%).
- 1 CVE scores Critical and 3 High on CVSS v3 (maximum 9.8, average 8.3); sequence these after KEV and high-EPSS items.
- 4 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

## About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-07 and refresh daily.

Canonical: https://intel.threadlinqs.com/vendors/wordpress
All vendors: https://intel.threadlinqs.com/vendors
Full detection coverage and IOCs for threats exploiting WordPress products unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp