CVE-2026-60137 — WordPress Core: WordPress Core SQL Injection Vulnerability

1. Executive summary

WordPress Core contains a SQL injection vulnerability (CVE-2026-60137, CVSS 5.9 MEDIUM) in the author__not_in parameter of WP_Query, affecting versions 6.8.x through 7.0.x. This vulnerability is actively exploited in the wild — added to the CISA KEV on 2026-07-21 — and can be chained with CVE-2026-63030 (CVSS 9.8 CRITICAL), a REST API batch-route confusion flaw, to achieve unauthenticated remote code execution (RCE) on default WordPress installations. EMEA financial services running self-managed WordPress sites for public-facing content, marketing, or customer portals face immediate risk of complete system compromise, credential exfiltration, and downstream malware deployment.

2. Regulatory framing

3. Technical analysis & attack chain

Vulnerability details

CVE-2026-60137 (CVSS 5.9 MEDIUM, CWE-89 — SQL Injection): WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query. When a plugin or theme passes untrusted input to this parameter, SQL injection becomes possible. The vulnerability is present in WordPress 6.8.0 and later. EPSS: 4%. In CISA KEV (added 2026-07-21).

CVE-2026-63030 (CVSS 9.8 CRITICAL, CWE-436 — Interpretation Conflict): REST API batch-route confusion vulnerability introduced in WordPress 6.9. A route confusion flaw causes the arrays containing sub-requests, validation results, and matched handlers to become misaligned, causing WordPress to treat all requests as trusted — including those it should block. EPSS: 9%. In CISA KEV (added 2026-07-21).

Chain scope: CVE-2026-60137 affects WordPress 6.8.0–6.8.5 as a standalone SQL injection issue. The full RCE chain (CVE-2026-63030 + CVE-2026-60137) is only achievable on WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1, because CVE-2026-63030 was introduced in WordPress 6.9. WordPress versions prior to 6.8 are not affected by either vulnerability.

Note on CVSS discrepancy: Rapid7's blog references a CVSS score of 7.5 for CVE-2026-63030 from the GitHub Security Advisory. The verified NVD/CISA KEV data assigns CVSS 9.8 CRITICAL. We use the verified value; the discrepancy likely reflects an initial advisory assessment later superseded by NVD enrichment.

Confirmed attack chain

1. Initial access — REST API batch endpoint: The attacker sends an unauthenticated HTTP POST request to /?rest_route=/batch/v1 (or /wp-json/batch/v1) with Content-Type: application/json. The request uses the batch API to nest sub-requests. No authentication, no plugins, and no user interaction are required. The vulnerable code path is reached when a persistent object cache is not in use (per Cloudflare).
2. Route confusion bypass (CVE-2026-63030): The batch request contains deliberately structured sub-requests that trigger the route confusion flaw. The arrays for sub-requests, validation results, and matched handlers become misaligned, causing WordPress to treat unauthenticated requests as trusted.
3. SQL injection via WP_Query (CVE-2026-60137): The attacker crafts a GET sub-request to /wp/v2/posts/999999 with the author_exclude parameter containing a SQL injection payload. The observed exploit uses a UNION SELECT statement injected via author_exclude=0) UNION SELECT .... The initial probe query tests for vulnerability by injecting a CONCAT(0x7c7c, HEX(CAST((SELECT 0x4f4b) AS CHAR)), 0x7c7c) — which returns ||OK|| — confirming SQL injection is possible.
4. Remote code execution — webshell injection: A second request delivers the actual exploit payload via the same SQL injection vector. The UNION SELECT injects a PHP webshell into a WordPress post. The decoded payload is a PHP script that: - Disables error reporting (error_reporting(0)) and display errors (ini_set('display_errors', 0)) - Requires a key parameter p matching the value 94uh9ubh6e1x; returns a 404 page if the key is absent or incorrect - Accepts commands via parameter b (base64-decoded using base64_decode, with the function name obfuscated as hex escapes \x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6f\x64\x65) or parameter c (raw) - Attempts command execution via system() (obfuscated as \x73\x79\x73\x74\x65\x6d), falling back to passthru() (\x70\x61\x73\x73\x74\x68\x72\x75), then exec() (\x65\x78\x65\x63) - Captures output via ob_start() / ob_get_clean()
5. Post-exploitation — observed behaviours: Following successful exploitation, multiple security firms report: - Exfiltration of hashed credentials (observed by watchTowr on Saturday morning, July 19) - Creation of backdoor administrator accounts (watchTowr observed 100+ backdoor accounts created by different threat actors using variations of public tooling) - Deployment of fake WordPress plugins to maintain persistence and achieve RCE - Download of additional tooling, including in one observed case an attempt to pull down Overlord RAT, a Golang-based remote access trojan - Indiscriminate internet-wide scanning and exploitation ("spraying the internet")

Exploitation timeline

• 2026-07-17: WordPress released security updates and GitHub Security Advisories. Adam Kues (Searchlight Cyber) published initial research on CVE-2026-63030, dubbed "wp2shell." wp2shell.com checker launched.
• 2026-07-19 (Saturday): Successful exploitation underway. watchTowr observed credential exfiltration, followed by RCE once additional details became public. Patchstack confirmed in-the-wild exploitation. Hexastrike observed exploitation attempts in honeypots.
• 2026-07-20: SANS ISC reported exploit attempts hitting honeypots. VulnCheck verified 24+ unique proof-of-concept exploits. Searchlight Cyber published full technical breakdown. ANSSI (CERT-FR) published alert CERTFR-2026-ALE-007.
• 2026-07-21: Both CVEs added to CISA KEV.

Attribution

No named threat actor has been identified in the source material. watchTowr noted "more than 100 backdoor accounts created by different threat actors using variations of public tooling," indicating multiple unattributed actors leveraging public exploit code. Attribution is unconfirmed.

Confidence caveats

• The exploit payload details (webshell structure, command execution chain) are single-sourced to the SANS ISC reader submission of a captured SecurityOnion request. The payload structure is consistent with the attack chain described by Tenable and The Register, but the exact webshell code is from one source.
• The Overlord RAT observation is single-sourced to watchTowr via The Register.
• AI-assisted exploit development is a researcher assessment (Jake Knott, watchTowr), not a confirmed fact.

4. Mitigation & containment

P1 — Within 24 hours

1. Inventory and assess: Identify all WordPress installations across the estate. Determine versions for each. Prioritise internet-facing installations running WordPress 6.9.0–6.9.4 or 7.0.0–7.0.1 (vulnerable to full RCE chain) and 6.8.0–6.8.5 (vulnerable to standalone SQLi).
2. Patch immediately: - WordPress 6.9.x → upgrade to 6.9.5 - WordPress 7.0.x → upgrade to 7.0.2 - WordPress 6.8.x → upgrade to 6.8.6 - WordPress 7.1 Beta → upgrade to 7.1 Beta 2 - WordPress versions prior to 6.8 → no action required for these CVEs - WordPress maintainers enabled forced auto-updates for affected installations; verify that auto-update succeeded on every asset rather than assuming.
3. Contain suspected compromises: If a site running an affected version has had the REST API exposed to the internet since July 17, assume compromise. Isolate the host. Preserve forensic evidence (web server access logs, database contents, filesystem for webshell discovery). Check for: - Unrecognised administrator accounts in wp_users - Fake or recently modified plugins in wp-content/plugins/ - PHP files containing base64_decode, system, passthru, or exec calls in unexpected locations - The webshell key 94uh9ubh6e1x in filesystem or logs
4. Block REST API batch endpoint (interim containment): If patching cannot be completed immediately, restrict or disable access to /wp-json/batch/v1 and /?rest_route=/batch/v1 at the WAF, reverse proxy, or web server configuration. This breaks the exploit chain but is a temporary measure only.

P2 — Within 72 hours

5. Log review and compromise assessment: For all WordPress instances that were running affected versions with internet-facing REST API exposure between July 17 and patch date: - Review web server access logs for POST requests to batch/v1 with User-Agent: cve-2026-63030/1.0 - Review access logs for GET requests to /wp/v2/posts/ containing author_exclude or author__not_in parameters with UNION SELECT - Check database for posts with anomalous content (PHP code, base64 strings) - Rotate all WordPress credentials (admin passwords, database credentials, API keys, JWT secrets) - Review authentication logs for new admin account creation
6. Enable persistent object cache: Cloudflare notes the vulnerable code path is reached when a persistent object cache is not in use. Enabling a persistent object cache (e.g., Redis, Memcached) may reduce exposure as a defence-in-depth measure, but this is NOT a substitute for patching.

P3 — Within 7 days

7. Hardening: Disable the WordPress REST API where it is not required for site functionality. Implement WAF rules to inspect and filter batch API requests. Ensure WordPress auto-updates are enabled for future security releases. Review and minimise plugin/theme attack surface.
8. CISA KEV remediation due dates: CVE-2026-60137 remediation due 2026-08-04. CVE-2026-63030 remediation due 2026-07-24. Both require application of vendor mitigations per BOD 26-04 guidance.

5. Indicators of compromise

user-agent  cve-2026-63030/1.0
http-path  /?rest_route=/batch/v1
http-path  /wp-json/batch/v1
http-param  author_exclude UNION SELECT
http-param  author__not_in SQL injection
webshell-key  94uh9ubh6e1x
webshell-param  p
webshell-param  b
webshell-param  c
malware  Overlord RAT

Behavioural indicators

6. Detection

rule WordPress_wp2shell_Webshell_CVE_2026_63030 {
  meta:
    author = "Adverse Trace"
    date = "2026-07-22"
    reference = "https://isc.sans.edu/diary/rss/33168"
    description = "Detects wp2shell webshell payload injected via WordPress REST API SQL injection chain (CVE-2026-63030 + CVE-2026-60137)"
  strings:
    $key = "94uh9ubh6e1x" ascii
    $param_p = "\"p\"" ascii
    $param_b = "\"b\"" ascii
    $param_c = "\"c\"" ascii
    $hex_base64_decode = "\\x62\\x61\\x73\\x65\\x36\\x34\\x5f\\x64\\x65\\x63\\x6f\\x64\\x65" ascii
    $hex_system = "\\x73\\x79\\x73\\x74\\x65\\x6d" ascii
    $hex_passthru = "\\x70\\x61\\x73\\x73\\x74\\x68\\x72\\x75" ascii
    $hex_exec = "\\x65\\x78\\x65\\x63" ascii
    $ob_start = "ob_start" ascii
    $ob_get_clean = "ob_get_clean" ascii
    $http_response_code = "http_response_code(404)" ascii
    $doctype = "<!DOCTYPE html><html><body><h1>404 Not Found</h1></body></html>" ascii
  condition:
    $key and 3 of ($hex_base64_decode, $hex_system, $hex_passthru, $hex_exec) and 2 of ($ob_start, $ob_get_clean, $http_response_code, $doctype)
}

title: Detect WordPress wp2shell REST API Batch Endpoint Exploitation
id: 7a3c1f2e-2026-4b8d-9e1a-adversetrace001
status: experimental
description: Detects exploitation attempts targeting CVE-2026-63030 and CVE-2026-60137 via WordPress REST API batch endpoint
references:

  - https://isc.sans.edu/diary/rss/33168
  - https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution
author: Adverse Trace
date: 2026/07/22
logsource:
  category: webserver
detection:
  selection_batch_route:
    c-uri|contains:

      - "/batch/v1"
      - "rest_route=/batch/v1"
    cs-method: POST
  selection_user_agent:
    c-user-agent|contains: "cve-2026-63030"
  selection_sqli_param:
    c-uri|contains:

      - "author_exclude"
      - "author__not_in"
    c-uri|contains:

      - "UNION"
      - "SELECT"
  condition: (selection_batch_route and selection_user_agent) or (selection_batch_route and selection_sqli_param)
fields:

  - c-ip
  - c-user-agent
  - c-uri
  - cs-method
  - c-host
falsepositives:

  - Security researchers running the wp2shell.com checker tool
  - Authorised vulnerability scanners
level: critical

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD, CVE-2026-60137 — WordPress Core SQL Injection Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-60137, 2026-07-20
• NVD, CVE-2026-63030 — WordPress Core Interpretation Conflict Vulnerability, https://nvd.nist.gov/vuln/detail/CVE-2026-63030, 2026-07-20
• SANS Internet Storm Center, WordPress Exploitation Underway (CVE-2026-63030), https://isc.sans.edu/diary/rss/33168, 2026-07-20
• Tenable Research, wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Core, https://www.tenable.com/blog/wp2shell-cve-2026-63030-cve-2026-60137-frequently-asked-questions-about-remote-code-execution, 2026-07-20
• The Register, Attackers pummel critical WordPress vuln to create all sorts of mischief, https://www.theregister.com/security/2026/07/20/attackers-pummel-critical-wordpress-vuln-to-create-all-sorts-of-mischief/5275265, 2026-07-20
• Rapid7, CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Core, https://www.rapid7.com/blog/post/etr-cve-2026-63030-wp2shell-a-critical-remote-code-execution-vulnerability-in-wordpress-core, 2026-07-17
• ANSSI France CERT, Multiples vulnérabilités dans WordPress, https://www.cert.ssi.gouv.fr/alerte/CERTFR-2026-ALE-007/, 2026-07-20

8. Adverse Trace position

Severity: CRITICAL (chained). While CVE-2026-60137 is individually rated MEDIUM (CVSS 5.9), the chained exploit with CVE-2026-63030 (CVSS 9.8 CRITICAL) produces unauthenticated, precondition-free RCE on default WordPress installations. Both CVEs are in the CISA KEV with active exploitation confirmed by multiple independent sources (watchTowr, Patchstack, Hexastrike, VulnCheck, SANS ISC honeypots). The attack requires no credentials, no plugins, and no user interaction. Public PoC code is circulating, VulnCheck has identified 24+ unique exploits, and watchTowr has observed 100+ backdoor accounts created by multiple actors. For EMEA financial services, any internet-facing WordPress installation running 6.9.0–6.9.4 or 7.0.0–7.0.1 should be treated as potentially compromised if the REST API was exposed since July 17, 2026. WordPress auto-updates have been force-enabled, but clients must verify patch success on every asset. The CISA KEV remediation deadline for CVE-2026-63030 is 2026-07-24 — two days from issuance. We are monitoring for additional actor attribution, new IOCs from confirmed intrusions, and any evidence of ransomware deployment following the observed Overlord RAT download attempts.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.