Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-60137 5.9
WordPress · Core · Added 2026-07-21 · Published 2026-07-17
3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityWordPress Core SQL Injection Vulnerability
VendorWordPress
ProductCore
Date added2026-07-21
Due date2026-08-04
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-89
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Descriptions

KEV: WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

NVD: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Compliance SSVC + BOD 26-04

Automatableno
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline14 days
Forensic (public)Required
Forensic (non-public)Not required

Research metadata

Last researched2026-08-25 19:48 UTC
Wall time0.6s
Searches2
Component defaultyes
Sources https://www.wordfence.com/blog/2026/07/psa-wordpress-core-patched-unauthenticated-remote-code-execution-vulnerability-chain/
https://www.cyber.gc.ca/en/alerts-advisories/wordpress-security-advisory-av26-723
https://nvd.nist.gov/vuln/detail/CVE-2026-60137
https://github.com/eyesecurity/wp2shell-compromise-scanner-plugin
https://github.com/0xWhoknows/wp2shell
https://github.com/SentinelXofficial/sxwp2shell
https://github.com/NULL200OK/WP2Shell
https://github.com/ikow/wp2shell
https://github.com/mverschu/CVE-2026-63030

Hunting hypothesis agent

Hunt access logs for POST requests to /wp-json/batch/v1 with "http://:" path primers where author_exclude parameter values contain SQL injection patterns (SLEEP, ASCII, SUBSTRING) on WordPress 6.8.x-7.0.x.

Research details

ComponentWP_Query author__not_in parameter sanitization — unsanitized input passed to SQL when plugins/themes expose the parameter
PreconditionsNetwork reachability to the affected interface or service — no authentication barrier; Target must run a vulnerable version of Core agent
DeliveryNetwork (HTTP/HTTPS); unauthenticated POST to /wp-json/batch/v1 using CVE-2026-63030 batch route confusion to route requests through WP_Query's author__not_in parameter, which lacks proper sanitization when plugins or themes pass untrusted input.
Public PoCyes
PoC URLs https://github.com/NULL200OK/WP2Shell
https://github.com/ikow/wp2shell
https://github.com/SentinelXofficial/sxwp2shell
https://github.com/0xWhoknows/wp2shell
https://github.com/eyesecurity/wp2shell-compromise-scanner-plugin Third-party repos; verify before use.
Advisoryhttps://www.wordfence.com/blog/2026/07/psa-wordpress-core-patched-unauthenticated-remote-code-execution-vulnerability-chain/
Exploit notesPublic PoC available (wp2shell tool). Standalone SQL injection in author__not_in WP_Query parameter; requires chaining with CVE-2026-63030 batch route confusion for unauthenticated exploitation. When a plugin or theme passes untrusted input to author__not_in, full UNION-based injection is possible. CVSS attack complexity: HIGH | MEDIUM severity (CVSS 5.9).
SummaryWordPress Core 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 contains a SQL injection vulnerability (CWE-89) in the author__not_in parameter of WP_Query, which lacks proper sanitization when a plugin or theme passes untrusted input. When chained with CVE-2026-63030's batch route confusion, this enables unauthenticated UNION-based SQL injection leading to full Remote Code Execution on default WordPress installations. The wp2shell PoC tool combines both vulnerabilities into a single exploitation pipeline with time-based blind detection and automated admin creation.

Tia coverage

First reported2026-07-18
First exploit report2026-07-20
Exploit report → KEV1 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

north-korea-infects-thousands-of-devices-worldwide-through-faketiktouk-wordpress-toolkit-could-enable-aws-smtp-and-api-credentiwp2shell-cisa-adds-to-kev-wiz-details-webshell-installation-at-s

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub