Act Now: WordPress Vulnerability Threatens SMB Websites

A WordPress SQL injection vulnerability is being actively exploited, and SMBs using WordPress are at risk.

The short version

A SQL injection vulnerability in WordPress is being actively exploited.
SMBs using WordPress should update to the patched version immediately.
Check your WordPress version to confirm if you're vulnerable.
Verify the patch is applied and consider a security review.

What is the WordPress SQL Injection Vulnerability?

SQL injection is a type of attack where hackers insert malicious code into a website’s database to steal or manipulate data. In this case, the vulnerability (CVE-2026-60137) exists in the core of WordPress, allowing attackers to run unauthorized SQL commands on your site’s database.

This means an attacker could potentially steal user data, change website content, or even take control of your site. Since WordPress is used by millions of websites — including many small businesses — this flaw poses a real risk to your business.

CISA has confirmed this vulnerability is being actively exploited in the wild, and a patch is available. But it’s up to you to apply it.

Is My SMB Affected?

If your business website is built on WordPress and you haven’t updated to the patched version, you may be vulnerable. This includes any site using WordPress for blogs, product pages, or customer portals.

Hackers use automated tools to scan for unpatched sites. Even if you think you’re not a target, your site could be exploited simply because it’s running a vulnerable version of WordPress.

While there’s no indication this vulnerability is being used for ransomware, it can still lead to data theft, site defacement, or loss of customer trust — all of which can hurt your business.

What Should I Do This Week?

Update your WordPress installation to the patched version. As of the CISA advisory, the fix is available in version 6.6.1. If you're not technical, ask your web developer or IT team to apply the update now.

Make sure no plugins or themes are preventing the update. Some third-party tools may not yet be compatible with the latest WordPress version. Check for plugin updates or temporarily deactivate them if needed.

After updating, confirm the new version is running. You can do this by logging into your WordPress dashboard and checking the version number under Help > About. If you’re unsure, ask a trusted professional to verify the update.

How Can I Tell if My Site Was Already Hacked?

Look for unusual changes on your website — like unexpected pages, redirects, or strange content. These could be signs of unauthorized access.

Check your WordPress dashboard for unfamiliar login attempts or users. If you see activity you didn’t initiate, it could mean someone has accessed your site.

Review your site’s database for suspicious entries, such as unknown user accounts or modified data. If you’re not comfortable doing this yourself, have a cybersecurity professional inspect your site for signs of SQL injection activity.

Not sure whether your environment is exposed? That is exactly what our Vulnerability Management service is built to surface. Talk to us.

Frequently asked questions

What exactly is SQL injection?

SQL injection is a method where attackers insert malicious SQL commands into a website’s database queries, allowing them to steal, alter, or delete data stored in the database.

Can this vulnerability be used for ransomware?

There is no evidence that this vulnerability is being used for ransomware attacks. However, it could still be used for data theft or site defacement, which can be very damaging for your business.

I’m not technical. Who can help me fix this?

You can work with your web developer, IT team, or hire a cybersecurity expert to update your site and ensure it’s secure.

What if I can’t update right now?

If you can’t update immediately, consider limiting access to your database and monitoring for suspicious activity. These are only temporary measures — updating is the best way to secure your site.

How can I be sure my site is patched?

After updating, check the WordPress version in the dashboard. If it shows 6.6.1 or later, the patch is applied. For extra assurance, have a cybersecurity professional confirm the patch is active and check for signs of prior exploitation.

How long do I have to fix this?

CISA has given federal agencies until August 4, 2026, to remediate. For SMBs, the sooner you act, the better. Delaying increases your risk of being exploited.

Source (public domain): CISA