CVE-2026-60137 – Critical WordPress Core SQL Injection (wp2shell)

Key takeaways

• Critical WordPress core SQL injection (author__not_in parameter) can be chained with CVE‑2026‑63030 to achieve pre‑authentication remote code execution.
• Affected versions: 6.8.x < 6.8.6, 6.9.x < 6.9.5, 7.0.x < 7.0.2.
• Listed in CISA KEV with active exploitation observed; exploit code is publicly available.
• Immediate patch to WordPress 6.9.5 or 7.0.2 (or later) is required; apply mitigations if you cannot patch immediately.
• Monitor for anomalous WP_Query usage and unexpected web‑shell uploads.

Overview

On 2026‑07‑17 WordPress released a security advisory for a critical flaw in the core. The vulnerability resides in the author__not_in argument of the WP_Query class, which fails to properly sanitize input, leading to CWE‑89 (SQL injection). Because the flaw can be triggered without authentication, it was quickly added to the CISA KEV catalog on 2026‑07‑21. When combined with the concurrently disclosed CVE‑2026‑63030—REST batch route confusion—the two bugs form the “wp2shell” chain that grants unauthenticated remote code execution (RCE). Threat intel feeds reported active exploitation within 24 hours, and public proof‑of‑concepts are circulating.

Technical Details

WP_Query builds SQL statements based on supplied arguments. The author__not_in parameter expects a comma‑separated list of author IDs, but the implementation concatenates the value directly into the query string without escaping. An attacker can inject arbitrary SQL, for example:

GET /?author__not_in=1%20UNION%20SELECT%20user_login,user_pass,1,1%20FROM%20wp_users-- HTTP/1.1
Host: vulnerable-site.com

The payload above extracts credential hashes from the wp_users table. By chaining this SQL injection with CVE‑2026‑63030—which allows arbitrary REST batch requests—an attacker can write a PHP web shell to the wp-content/uploads directory and execute it, achieving full site compromise. The combined exploit is commonly referred to as wp2shell.

Severity & Impact

The higher CVSS score reflects the low attack complexity when the two bugs are chained, making the vulnerability Critical.

Affected Products

The flaw impacts the following WordPress core releases:

• 6.8.x before 6.8.6
• 6.9.x before 6.9.5
• 7.0.x before 7.0.2

For a complete list of affected versions and CPE identifiers, see the VulnSocial CVE page.

Actionable Insights – What to Do

• Identify: Run wp core version or check the admin dashboard to confirm your version.
• Patch: Immediately apply the official update to WordPress 6.9.5, 7.0.2, or any newer release.
• Mitigate (if patching is delayed):
  • Disable the REST API or restrict /wp-json/ access to trusted IPs.
  • Deploy a WAF rule that blocks requests containing the author__not_in parameter with SQL keywords (e.g., UNION, SELECT).
  • Audit custom plugins/themes for unsafe WP_Query usage and enforce esc_sql() or prepared statements.
• Detect: Enable logging for author__not_in queries and for the /wp-json/wp/v2/batch endpoint. Alert on HTTP 500/403 responses from these endpoints.
• Contain: Monitor wp-content/uploads for newly created PHP files; use file integrity monitoring to detect web‑shell drops.
• Investigate: If compromise is suspected, isolate the site, rotate all WordPress admin passwords, and review user accounts for unauthorized additions.

Remediation & Mitigation Steps

1. Patch WordPress – Update to 6.9.5, 7.0.2, or later via the built‑in updater or by downloading the latest package from the official site.
2. Sanitize Input – Review any custom code that calls WP_Query. Ensure all arguments are escaped with esc_sql() or use $wpdb->prepare().
3. Restrict REST API – If the REST API is not required, disable it with add_filter('rest_enabled', '__return_false'); or use a security plugin to limit access.
4. Deploy WAF/IPS Signatures – Add rules to block patterns like author__not_in=.*(UNION|SELECT).* and to detect malformed batch requests.
5. Log & Alert – Configure your web server or WAF to log requests that contain the author__not_in parameter and to generate alerts for any batch endpoint activity.
6. Backup & Test Recovery – Verify that recent backups exist and can be restored quickly in case of a successful compromise.

Bottom Line

CVE-2026-60137 is a Critical SQL injection in WordPress core that, when chained with CVE‑2026‑63030, enables unauthenticated remote code execution. The vulnerability is actively exploited and listed in the CISA KEV catalog. Immediate patching to the latest WordPress release, combined with defensive controls such as WAF rules and REST API restrictions, is essential to protect sites from the “wp2shell” attack chain.

References

• Vendor advisory (GHSA‑fpp7‑x2x2‑2mjf): https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
• WordPress 7.0.2 release notes: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
• CISA KEV entry for CVE-2026-60137: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
• Live threat intelligence and timeline: https://vulnsocial.com/cve/CVE-2026-60137

#CVE #CVE202660137 #Critical #RCE #CISAKEV #WordPress #SQLi #wp2shell