Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-60137 – SQL Injection Leading to Unauthenticated RCE – WordPress Core 6.8.x / 6.9.x / 7.0.x

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-60137 is a SQL injection vulnerability (CWE-89) in WordPress Core arising from improper sanitization of the author__not_in parameter in the WP_Query class, affecting WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. When chained with a companion REST API batch-route confusion vulnerability (CVE-2026-63030), the combined exploit — publicly known as wp2shell — enables fully unauthenticated remote code execution on WordPress 6.9.x and 7.0.x. Active in-the-wild exploitation has been confirmed since the July 17, 2026 disclosure, and WordPress.org has enabled forced automatic security updates for all affected installations.

Technical details

  • Root cause: The author__not_in parameter of WP_Query is not properly sanitized, allowing injection of malicious SQL (CWE-89: Improper Neutralization of Special Elements used in an SQL Command). In WordPress’s default configuration, access to this parameter is restricted to authenticated users; exploitation by unauthenticated attackers in isolation requires a plugin or theme that exposes the parameter without an authentication check.
  • Attack chain (wp2shell): CVE-2026-63030, a REST API batch-route confusion vulnerability affecting WordPress 6.9.x and 7.0.x, bypasses the authentication blocklist that protects the author__not_in injection path. When combined, the two vulnerabilities allow a fully unauthenticated remote attacker to reach and exploit the SQL injection endpoint without any plugin or theme dependency.
  • Attack vector: Network-accessible, no authentication or user interaction required for the full wp2shell chain.
  • Impact: Successful exploitation of the wp2shell chain enables database exfiltration, rogue administrator account creation, malicious plugin upload, and full server-level remote code execution. CVE-2026-60137 in isolation (without CVE-2026-63030) results in SQL injection with high confidentiality and integrity impact.

Affected software

  • WordPress 6.8.0 through 6.8.5 — affected by CVE-2026-60137 only
  • WordPress 6.9.0 through 6.9.4 — affected by both CVE-2026-60137 and CVE-2026-63030
  • WordPress 7.0.0 through 7.0.1 — affected by both CVE-2026-60137 and CVE-2026-63030
  • WordPress versions prior to 6.8 are not affected

Severity

Two CVSS v3.1 base scores are published at NVD for this CVE:

  • 5.9 MEDIUM (assigned by WPScan, the CNA): CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
  • 9.1 CRITICAL (assigned by CISA-ADP, reflecting the full wp2shell attack chain): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Mitigation and recommended actions

  • Immediate (patch): Upgrade to the following vendor-released fixed versions:

    • WordPress 6.8.x → 6.8.6
    • WordPress 6.9.x → 6.9.5
    • WordPress 7.0.x → 7.0.2

    WordPress.org has enabled forced automatic security updates for all affected installations due to the severity of this vulnerability. Sites with auto-updates enabled will receive the fix automatically.

  • If immediate patching is not possible: For WordPress 6.9.x and 7.0.x, restrict unauthenticated access to the REST API batch endpoint (/wp-json/batch/v1) via WAF rules or web server configuration as a temporary measure. Additionally, audit any plugins or themes that pass untrusted user input to the author__not_in parameter of WP_Query and disable or restrict them until patching is complete.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge