Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data
A Chinese threat actor exploited critical WordPress vulnerabilities to steal 18,566 sensitive records from a Western government organization across 29 countries.
90
Threat actor
Chinese-speaking threat actor
- Mentions · 7d0
- Mentions · 30d0
- All mentions2
- First seenAug 19, 2026
- Last mentionedSep 22, 2026
Timeline
2 articles · newest firstCritical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation
CISA added four critical actively exploited flaws to KEV: macOS Screen Sharing, SharePoint, VMware vCenter, and Microsoft IKE, with APT and ransomware use.
86
Related CVEs
by mentions- CVE-2026-6540018%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-3382477%9.8Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-5931062%9.8Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
Appears with
- Monero minermalware · 1
- MCAthreat actor · 1
- VMwarevendor · 1
- CISAorganization · 1
- Microsoft Internet Key Exchange Service Extensionsproduct · 1
- VMware vCenterproduct · 1
- reverse_sshmalware · 1
- Unit 42organization · 1
- Broadcomvendor · 1
- Russian state entityvictim · 1
- macOSproduct · 1
- Applevendor · 1
- DeepSeekai model · 1
- China-nexus APTthreat actor · 1
- Western government organizationvictim · 1
- Microsoftvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.