Summary
CVE-2026-60137 is a critical SQL injection vulnerability in WordPress caused by improper sanitization of the author__not_in parameter in WP_Query. It affects WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. Alone, it enables SQL injection. When chained with CVE-2026-63030 (wp2shell), it can lead to unauthenticated remote code execution. Public exploits and active exploitation have been confirmed, and the flaw is listed in CISA’s KEV Catalog. Update WordPress immediately.
Urgent Actions Required
- Update WordPress to 6.8.6, 6.9.5, or 7.0.2.
- Verify the update was successfully applied.
- Check for unexpected admin accounts, malicious plugins, or suspicious files.
- If patching is delayed, block access to /wp-json/batch/v1 and ?rest_route=/batch/v1 using a WAF.
- Reset passwords if the site may have been exposed before patching.
Which Systems Are Vulnerable to CVE-2026-60137?
Technical Overview
- Vulnerability Type: SQL Injection in WP_Query (author__not_in Parameter)
- Affected Software/Versions:
- WordPress 6.8.0 - 6.8.5
- WordPress 6.9.0 - 6.9.4
- WordPress 7.0.0 - 7.0.1
- CVSS Vector: v3.1
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None
- Patch Availability: Yes, available
How Does the CVE-2026-60137 Exploit Work?
The attack typically follows these steps:
What Causes CVE-2026-60137?
Vulnerability Root Cause:
The vulnerability is caused by improper sanitization of the author__not_in parameter in WP_Query. When a plugin or theme passes untrusted input to this parameter, the value is not properly sanitized before being used in a database query. As a result, an attacker can inject malicious SQL, potentially exposing or manipulating database data.
How Can You Mitigate CVE-2026-60137?
If immediate patching is delayed or not possible:
- Identify and update plugins or themes that pass untrusted input to the author__not_in parameter of WP_Query.
- Configure a web application firewall (WAF) or security plugin to detect and block SQL injection attempts targeting the author__not_in parameter.
- Monitor logs for unusual database queries or suspicious SQL injection activity.
- If the vulnerability is part of the wp2shell attack chain, temporarily block anonymous access to the REST batch endpoint (/wp-json/batch/v1 and ?rest_route=/batch/v1) until the site can be updated.
Which Assets and Systems Are at Risk?
- Asset Types Affected:
- WordPress Websites - Running affected WordPress versions (6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2)
- WordPress Plugins and Themes - Those that pass untrusted input to the author__not_in parameter of WP_Query
- Business-Critical Systems at Risk:
- Public-Facing WordPress Websites - Vulnerable sites exposed to the internet
- WordPress Installations Handling Sensitive Data - Sites where database information could be exposed through SQL injection
- Exposure Level:
- Internet-Accessible WordPress Sites - Especially those running affected versions
- Sites Using Vulnerable Plugins or Themes - Where untrusted input is passed to the author__not_in parameter
Will Patching CVE-2026-60137 Cause Downtime?
Patch application impact: Updating to WordPress 6.8.6, 6.9.5, or 7.0.2 requires a standard WordPress update. Downtime is typically minimal.
How Can You Detect CVE-2026-60137 Exploitation?
Exploitation Signatures:
Look for requests targeting the /wp-json/batch/v1 or ?rest_route=/batch/v1 endpoints, especially if followed by unusual activity such as administrator account creation or malicious plugin uploads.
Indicators of Compromise (IOCs/IOAs):
- Unexpected administrator accounts (for example, prefixes such as wp2_* or w2s_*).
- Administrator email addresses using @wp2shell.invalid or @wp2shell.shellcode.lol.
- Suspicious database artifacts, including oEmbed cache entries, customize_changeset records with unusually high parent IDs, orphaned usermeta, or user ID gaps.
- Unexpected or recently added plugins or PHP web shells.
Alerting Strategy:
- Priority: Critical
- Generate alerts for:
- Requests to /wp-json/batch/v1 or ?rest_route=/batch/v1.
- Creation of new administrator accounts.
- Installation of unexpected plugins or web shells.
- Suspicious changes to WordPress database records associated with the exploit chain.
Remediation & Response
- Incident Response Considerations:
- Check for unexpected administrator accounts, malicious plugins, and suspicious database artifacts.
- Preserve database and web root evidence before remediation if compromise is suspected.
- Reset all user passwords, as the SQL injection vulnerability may expose password hashes.
- Monitor WordPress infrastructure for suspicious activity and requests to the batch API endpoints.
Build A Stronger Cyber Defense with Real-Time Visibility
-
-
- Understand your cyber terrain across endpoints, servers, and cloud assets
- Prioritize high-risk assets with multidimensional risk analysis
- Improve detection and response using integrated XDR and deception technologies
-
CVSS Breakdown Table
| Metric | Value | Description |
|---|---|---|
| Base Score | 9.1 | Critical severity vulnerability |
| Attack Vector | Network | Can be exploited remotely over the network |
| Attack Complexity | Low | No special conditions are required for exploitation |
| Privileges Required | None | No authentication is required |
| User Interaction | None | Does not require user involvement |
| Scope | Unchanged | The vulnerability affects the vulnerable component |
| Confidentiality Impact | High | May expose sensitive information through SQL injection |
| Integrity Impact | High | May allow unauthorized modification of application data |
| Availability Impact | None | No direct impact on service availability |
References:
