U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added DD-WRT, Langflow, and WordPress flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Below are the flaws added to the KeV catalog:
- CVE-2021-27137 (CVSS score of 8.1) DD-WRT Stack-Based Buffer Overflow Vulnerability
- CVE-2026-0770 (CVSS score of 9.8) Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability
- CVE-2026-63030 (CVSS score of 9.8) WordPress Core Interpretation Conflict Vulnerability
- CVE-2026-60137 (CVSS score of 5.9) WordPress Core SQL Injection Vulnerability
The first issue added to the catalog is CVE-2021-27137, a buffer overflow vulnerability affecting DD-WRT before version 45724. The flaw exists in the UPnP handling functionality (ssdp.c) due to an unsafe strcpy operation in the ssdp_msearch function. An unauthenticated remote attacker could exploit the issue by sending a specially crafted M-SEARCH request to trigger a buffer overflow and potentially execute arbitrary code. Exploitation requires UPnP to be enabled, as it is disabled by default and typically limited to internal interfaces.
The second issue added to the catalog is CVE-2026-0770, a critical remote code execution vulnerability affecting Langflow. The flaw exists in the handling of the exec_globals parameter in the validate endpoint, where the application improperly loads functionality from an untrusted control sphere. An unauthenticated remote attacker can exploit the vulnerability to execute arbitrary code with root privileges on affected systems.
Regarding WordPress issues added to the catalog, public proof-of-concept exploits are now available for the critical wp2shell vulnerabilities affecting WordPress Core. The flaws, tracked as CVE-2026-63030 and CVE-2026-60137, can be chained to achieve pre-authentication remote code execution on default WordPress installations running versions 6.9.x and 7.0.x.
CVE-2026-63030 is a REST API batch-route confusion bug introduced in WordPress 6.9. CVE-2026-60137 is a high-severity SQL injection flaw in the author__not_in parameter of WP_Query, affecting.
“The 7.0.2 security release addresses one critical and one high severity security issue.” reads the WordPress announcement.
“Because this is a security release, it is recommended that you update your sites immediately. Due to the severity, the WordPress.org team have enabled forced updates via the auto-update system for sites running affected versions.”
Cybersecurity researchers at Searchlight Cyber discovered the flaws that can allow remote attackers to compromise vulnerable sites without valid credentials, making immediate patching essential.
“Searchlight Cyber’s security research team has discovered a pre-authentication RCE in WordPress Core. The attack has no preconditions and can be exploited by an anonymous user in a stock install of WordPress with no plugins.” reads the advisory. “It is estimated that over 500 million websites use WordPress.”
Researchers withheld technical details to give organizations time to patch, but released an online tool to help administrators check whether their WordPress instances are vulnerable.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix these flaws by July 24, 2026, except for CVE-2026-60137, which must be fixed by August 4.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
