Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

WordPress: actively exploited vulnerabilities

6 vulnerabilities in WordPress products are listed in CISA’s catalog of actively exploited vulnerabilities. Latest addition on September 25, 2026: CVE-2026-87902 (Core).

Affected products

  • Core3
  • File Manager Plugin1
  • Snap Creek Duplicator Plugin1
  • Social Warfare Plugin1

Our analyses

CERT-FR alerts and notices

Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.

  1. CERTFR-2026-AVI-1273

    Multiples vulnérabilités dans WordPress (07 octobre 2026)

  2. CERTFR-2026-ALE-007

    Multiples vulnérabilités dans WordPress (20 juillet 2026)

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2026 3 vulnerabilities

  1. CVE-2026-87902

    WordPress Core Remote File Inclusion Vulnerability

    NVD entryCISA catalog

  2. CVE-2026-63030

    WordPress Core Interpretation Conflict Vulnerability

    NVD entryCISA catalog

  3. CVE-2026-60137

    WordPress Core SQL Injection Vulnerability

    NVD entryCISA catalog

2021 3 vulnerabilities

  1. CVE-2020-25213

    WordPress File Manager Plugin Remote Code Execution Vulnerability

    NVD entryCISA catalog

  2. CVE-2020-11738

    WordPress Snap Creek Duplicator Plugin File Download Vulnerability

    NVD entryCISA catalog

  3. CVE-2019-9978

    WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.