CISA’s Latest Exploited-Vulnerability Alert Includes DD-WRT and WordPress: What Home Users Should Check
CISA added four actively exploited flaws to its KEV catalog, including DD-WRT, WordPress and Langflow issues. The practical lesson is boring but important: patch exposed routers, websites and apps before attackers use them as an entry point.
Quick takeaways
- CISA said on July 21 that it added four vulnerabilities to the Known Exploited Vulnerabilities catalog because there is evidence of active exploitation.
- The new entries include a DD-WRT stack-based buffer overflow, a Langflow issue, and two WordPress Core vulnerabilities, so the affected audience ranges from router tinkerers to website owners and AI-app teams.
- A VPN can protect traffic on untrusted networks, but it does not patch a vulnerable router, WordPress install, plugin stack, or exposed application server.
What happened?
CISA added four new vulnerabilities to its Known Exploited Vulnerabilities catalog on July 21, saying the entries were added because of evidence of active exploitation. The list includes CVE-2021-27137 in DD-WRT, CVE-2026-0770 in Langflow, and two WordPress Core issues: CVE-2026-63030 and CVE-2026-60137.
The KEV catalog is designed for federal vulnerability-management deadlines, but CISA also encourages all organisations to use it as a risk signal. In plain English: if a product you run appears in KEV, treat it as more urgent than an ordinary theoretical vulnerability because attackers are already using it somewhere.
Why it matters for ordinary readers
DD-WRT is popular with router enthusiasts and people who want more control over home-network features, including VPN routing. WordPress powers a large share of small-business and creator websites. Langflow is more developer-facing, but exposed AI workflow tools can still become a route into cloud accounts or internal systems if they are left open and unpatched.
The common thread is not that every home is suddenly under attack. It is that internet-facing tools often outlive their maintenance habits. A router flashed years ago, an old WordPress site, or a forgotten prototype app can become an entry point long after the owner stopped thinking about it.
What you can do now
If you run DD-WRT, check your exact build and device support status, then update from the official project or vendor route rather than downloading random firmware files from forums. If your router is no longer maintained, consider replacing it instead of relying on a VPN tunnel to compensate for the appliance itself being vulnerable.
If you run WordPress, make sure core updates are current, remove abandoned plugins and themes, check admin accounts, and confirm backups actually restore. If you manage Langflow or similar developer tools, keep them off the public internet unless there is a clear need, add authentication, and patch quickly when exploited issues appear.
Where a VPN helps — and where it does not
A VPN can encrypt your traffic on public Wi-Fi, hide your home IP address from many websites, and let you route supported devices through a privacy provider. A router-level VPN setup can also be convenient when you want whole-home coverage for devices that do not run VPN apps directly.
A VPN does not fix vulnerable firmware, stop a WordPress SQL injection, remove malware from a compromised server, or protect an exposed admin panel with weak credentials. Patch first, reduce exposure second, then use a VPN for connection privacy where it fits.
VPN Rocks view
This alert is a useful reminder that privacy tools sit on top of basic security. If the router, site, or app beneath them is exposed and unmaintained, a VPN cannot turn that weak foundation into a safe one.
Sources and further reading
VPN Rocks adds plain-English analysis and practical advice. Source links are included so readers can check the underlying guidance directly.