WordPress SQLi exploited in the wild (CVE-2026-60137) [PoC]
CVE-2026-60137
CVE-2026-60137: critical SQL injection in WordPress 6.8.x-7.0.x allowing unauthenticated DB reads/writes. CISA KEV listed, actively exploited. Update to 7.0.2, 6.9.5, or 6.8.6.
Actively exploited in the wild - CVE-2026-60137 is a critical SQL injection vulnerability in WordPress 6.8.x through 7.0.x that lets unauthenticated attackers read and modify the site database. Patched versions are available - upgrade immediately.
Overview
CVE-2026-60137 is a SQL injection flaw in WordPress core’s WP_Query class, affecting versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. The author__not_in parameter lacks proper sanitization, allowing attackers to inject arbitrary SQL when a plugin or theme passes untrusted input to this parameter. The vulnerability has a CVSS score of 9.1 (Critical) with no privileges or user interaction required, though successful exploitation requires non-default configurations.
Impact
A successful SQL injection allows an attacker to extract sensitive data from the WordPress database, including user credentials, password hashes, session tokens, and private post content. In some configurations, the attacker could also modify database records, escalate privileges, or achieve remote code execution through stacked queries. The EPSS score of 4.0% indicates a high likelihood of widespread exploitation attempts in the near term.
Affected Versions
- WordPress 6.8.x prior to 6.8.6
- WordPress 6.9.x prior to 6.9.5
- WordPress 7.0.x prior to 7.0.2
Remediation
WordPress has released patched versions that fix the sanitization issue. Update immediately:
- For 6.8.x sites: upgrade to version 6.8.6
- For 6.9.x sites: upgrade to version 6.9.5
- For 7.0.x sites: upgrade to version 7.0.2
For sites that cannot upgrade immediately, apply a Web Application Firewall (WAF) rule to block requests containing SQL injection patterns in the author__not_in parameter. Review custom code and third-party plugins that pass user input to WP_Query parameters and ensure they validate input before use.
Detection
Monitor web server logs for SQL error messages and unusual query patterns involving the author__not_in parameter. Check for unexpected database queries or modifications to wp_users tables.
Security Insight
This vulnerability highlights a recurring pattern in content management systems: core database abstraction layers that promise safe SQL handling but leave sanitization gaps in edge-case parameters. When an API accepts plugin-supplied values without requiring parameterized queries, the entire security model depends on every developer getting it right - an assumption that repeatedly fails in practice and drives the continued need for defense-in-depth.
Further Reading
Never miss a critical vulnerability
Get real-time security alerts delivered to your preferred platform.
Public PoC References
Unverified third-party code
These repositories are publicly listed on GitHub and have not been audited by Yazoul Security. They may contain malware, backdoors, destructive payloads, or operational security risks (telemetry, exfiltration). Treat them as hostile binaries. Inspect source before execution. Run only in isolated, disposable lab environments (offline VM, no credentials, no production data).
Authorized use only. This information is provided for defensive research, detection engineering, and patch validation. Using exploit code against systems you do not own or do not have explicit written permission to test is illegal in most jurisdictions and violates Yazoul's terms of use.
| Repository | Stars |
|---|---|
| codeb0ssx/Ultimate-wp2shell wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on | ★ 8 |
| h4cd0c/wp2shell wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on | ★ 0 |
| yoerivegt/wp2shell-poc wp2shell (CVE-2026-60137 / CVE-2026-63030) | ★ 0 |
Showing 3 of 3 known references. Source: nomi-sec/PoC-in-GitHub.
Related Advisories
Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers t...
Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to ...
SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php). This allows an unauthenticate...
A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote unauthenticated attackers to bypass authentication via the username parameter in index.php....