CISA Adds Four Actively Exploited Vulnerabilities Including WordPress RCE to KEV Catalog

Key Findings

• CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on July 21, 2026, all showing active exploitation in the wild
• Two WordPress Core flaws can be chained together to achieve pre-authentication remote code execution on default installations running versions 6.9.x and 7.0.x
• Langflow vulnerability allows unauthenticated remote code execution with root privileges, rated critical with CVSS 9.8
• DD-WRT router flaw is an older stack-based buffer overflow in UPnP handling, though exploitation requires UPnP to be enabled
• Federal agencies must patch these vulnerabilities by specified deadlines under Binding Operational Directive 22-01

Background

The CISA Known Exploited Vulnerabilities catalog tracks security flaws that attackers are actively exploiting in real-world attacks. When vulnerabilities land on this list, organizations face immediate pressure to patch because threat actors have already developed working exploits. Federal agencies must comply with patching deadlines, while CISA also recommends private organizations treat the catalog as a priority for their security operations.

WordPress RCE Chain

The two WordPress vulnerabilities represent a particularly dangerous scenario where attackers can chain lower-severity bugs into complete system compromise. CVE-2026-63030 is a REST API batch-route confusion bug introduced in WordPress 6.9, while CVE-2026-60137 is a SQL injection flaw in the author__not_in parameter of WP_Query. Individually, these bugs would be manageable, but together they enable pre-authentication remote code execution on default WordPress installations. Security researchers from Searchlight Cyber discovered these flaws and withheld technical details to give organizations time to patch, though they released a checking tool for administrators. WordPress 7.0.2 addresses both issues and has been pushed via forced auto-updates for affected versions. Given that over 500 million websites run WordPress, the impact of this chain could affect a massive portion of the internet if left unpatched.

Langflow Critical Flaw

CVE-2026-0770 affects the Langflow platform, which builds AI workflows and automation tools. The vulnerability exists in the validate endpoint where the application improperly loads functionality from an untrusted control sphere. An attacker can exploit the exec_globals parameter handling to execute arbitrary code with root privileges without any authentication. The critical CVSS 9.8 score reflects the severity of allowing unauthenticated remote code execution on systems that often handle sensitive business logic and data processing.

DD-WRT Router Vulnerability

CVE-2021-27137 is a stack-based buffer overflow in DD-WRT versions before 45724, residing in the UPnP handling functionality within ssdp.c. An unauthenticated attacker can send a specially crafted M-SEARCH request to trigger the overflow and potentially execute arbitrary code. However, exploitation has practical limitations since UPnP is disabled by default and typically restricted to internal network interfaces only. Despite the CVSS score of 8.1, this older vulnerability poses less immediate risk than the others on the list.

Patching Deadlines and Recommendations

Federal agencies operating under BOD 22-01 must address CVE-2021-27137, CVE-2026-0770, and CVE-2026-63030 by July 24, 2026, with CVE-2026-60137 receiving an extended deadline of August 4. Organizations should immediately update WordPress to versions 6.8.6, 6.9.5, or 7.0.2, deploy patches for Langflow, and disable UPnP on DD-WRT routers unless specifically needed. CISA encourages private sector organizations to treat these vulnerabilities with similar urgency, scanning their infrastructure for vulnerable instances and prioritizing rapid patching to prevent active exploitation.

Sources

• https://securityaffairs.com/195782/security/u-s-cisa-adds-dd-wrt-langflow-and-wordpress-flaws-to-its-known-exploited-vulnerabilities-catalog.html
• https://securityonline.info/cisa-kev-four-exploited-vulnerabilities/
• https://www.socdefenders.ai/item/e6838821-4d82-4a0d-8e11-c0dc4219a508
• https://mallory.ai/stories/019f85a8-eb00-7805-97f8-3d2cfea2e12a
• https://windowsforum.com/threads/cisa-kev-adds-wordpress-rce-chain-langflow-and-dd-wrt-flaws.439851/post-1002318
• https://www.reddit.com/r/pwnhub/comments/1v2qlx2/cisa_adds_four_new_vulnerabilities_to_known