CVE-2026-65640
Unrestricted file upload in WordPress
CVSS score
8.8
EPSS probability
%1.9
Risk score
0.2
Published
1 mo ago
Public Exploits · GitHub and Metasploit Intelligence
This tab scans the sources that NVD labels as exploits, GitHub repositories matching the CVE identifier and Rapid7 Metasploit Framework modules. Only links to sources that were actually found are shown.
GitHub
WordPress Core <= 7.0.3 - Authenticated (Author+) Remote Code Execution via Malicious File Upload
Makefile Go / Python
Similar Vulnerabilities
8.1
CVE-2026-87902 Actively exploited
Vulnerability in WordPress
W
Workaround Public Exploits:7EPSS %40
9.8
CVE-2026-63030 Actively exploited
WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution
W
Workaround Public Exploits:1EPSS %11
5.9
CVE-2026-60137 Actively exploited
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
W
WorkaroundEPSS %5
8.9
CVE-2026-64638
Cross-site scripting in WordPress
W
Patch status unknown Public Exploits:9EPSS %1
4.3
CVE-2023-39999
WordPress < 6.3.2 is vulnerable to Broken Access Control
W
Patch verifiedEPSS %1
-
CVE-2019-9978 Actively exploited
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
W
Workaround Public Exploits:11EPSS %73
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-65640"