Overview
CVE-2026-60137 is a SQL injection vulnerability affecting WordPress Core. While rated Medium severity on its own, it is critical because it can be chained with CVE-2026-63030 to enable unauthenticated remote code execution (RCE). This vulnerability is actively exploited, making immediate patching crucial for all WordPress administrators.
Technical Analysis
The vulnerability resides in the WP_Query component of WordPress Core, specifically in how it handles the author__not_in parameter. WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize untrusted input passed to this parameter by a plugin or theme. This allows an attacker to inject arbitrary SQL queries.
- Vulnerability Type: SQL Injection (
CWE-89) - Affected Versions:
- WordPress >= 6.8, < 6.8.6
- WordPress >= 6.9, < 6.9.5
- WordPress >= 7.0, < 7.0.2
- Prerequisites: A plugin or theme must pass untrusted input to the
author__not_inparameter ofWP_Query. - Attack Vector: Network (CVSS:3.1/AV:N)
- Impact: High confidentiality impact (CVSS:3.1/C:H), no integrity or availability impact on its own. When chained with
CVE-2026-63030, it leads to RCE. - CVSS 3.1 Score: 5.9 (MEDIUM)
Detection
- Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests containing
author__not_in=in the URI or POST body, especially when combined with common SQL injection payloads such asUNION SELECT,' OR 1=1--,SLEEP(), orLOAD_FILE(). Look for unusual HTTP status codes or response sizes following such requests. - Process Monitoring: On web servers, monitor for the web server process (e.g.,
httpd.exe,nginx.exe,php-fpm.exe,w3wp.exe) spawning unusual child processes, particularly command shells (cmd.exe,powershell.exe,sh,bash) or scripting interpreters, which could indicate successful RCE. - File Integrity Monitoring (FIM): Implement FIM on WordPress installation directories. Alert on the creation or modification of new
.phpfiles in web-accessible directories (wp-content,wp-includes, plugin/theme directories), as this could indicate a webshell drop. - Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual or known malicious IP addresses/domains, which might indicate command-and-control (C2) communication or data exfiltration post-exploitation.
Sigma Detection Rules
⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.
WordPress Core SQL Injection CVE-2026-60137 Attempt
title: WordPress Core SQL Injection CVE-2026-60137 Attempt
id: 9029a1b8-20d0-482a-97a6-407133f93282
status: experimental
description: Detects attempts to exploit CVE-2026-60137, a SQL injection vulnerability in WordPress Core's WP_Query author__not_in parameter.
logsource:
category: webserver
detection:
selection_uri:
- cs-uri-query|contains: 'author__not_in='
- c-uri|contains: 'author__not_in='
selection_sqli_patterns:
- cs-uri-query|contains:
- ' UNION SELECT '
- ' OR 1=1-- '
- ' AND 1=1-- '
- ' SLEEP('
- ' WAITFOR DELAY '
- ' LOAD_FILE('
- ' CONCAT('
- c-uri|contains:
- ' UNION SELECT '
- ' OR 1=1-- '
- ' AND 1=1-- '
- ' SLEEP('
- ' WAITFOR DELAY '
- ' LOAD_FILE('
- ' CONCAT('
condition: selection_uri and selection_sqli_patterns
level: high
Web Server Process Spawning Suspicious Shell (Windows)
title: Web Server Process Spawning Suspicious Shell (Windows)
id: 4b27f67d-93d3-4a11-a81d-66f688820c7a
status: experimental
description: Detects a web server process spawning a command shell, indicative of successful remote code execution, potentially via CVE-2026-60137 chaining.
logsource:
product: windows
service: sysmon
detection:
selection_parent:
ParentImage|endswith:
- '\php-fpm.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\w3wp.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
condition: selection_parent and selection_child
level: critical
Web Server Process Creating Suspicious PHP File (Windows)
title: Web Server Process Creating Suspicious PHP File (Windows)
id: 7e7f8e1a-5b0c-4d3e-8f9a-2c1d0e6f7b8c
status: experimental
description: Detects a web server process creating a new PHP file in a web-accessible directory, which could indicate a webshell drop after successful exploitation.
logsource:
product: windows
service: sysmon
definition: 'Requires Sysmon EventID 11 (FileCreate) to be enabled.'
detection:
selection_process:
Image|endswith:
- '\php-fpm.exe'
- '\httpd.exe'
- '\nginx.exe'
- '\w3wp.exe'
selection_file:
TargetFilename|endswith: '.php'
TargetFilename|contains:
- '\wp-content\uploads\'
- '\wp-content\plugins\'
- '\wp-content\themes\'
- '\html\'
- '\www\'
condition: selection_process and selection_file
level: high
Mitigations
- Patch Immediately: Update all affected WordPress installations to the latest patched versions: 6.8.6, 6.9.5, 7.0.2, or newer. This is the most critical step to prevent exploitation.
- Web Application Firewall (WAF): Deploy and configure a WAF to detect and block common SQL injection patterns, specifically targeting the
author__not_inparameter in WordPress requests. Ensure rules are updated to cover known exploitation patterns for this CVE. - Review Plugins and Themes: Audit all third-party and custom WordPress plugins and themes. Prioritize those that interact with
WP_Queryor user-supplied input forauthor__not_into ensure proper input sanitization and validation are in place. - Principle of Least Privilege: Ensure the web server process and its associated PHP processes run with the minimum necessary privileges to limit the impact of successful exploitation.
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-60137
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
- https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137
Indicators of Compromise
No public IOCs available at time of writing.
MITRE ATT&CK
T1190— Exploit Public-Facing ApplicationT1505.003— Web ShellT1140— Deobfuscate/Decode Files or InformationT1087— Account DiscoveryT1059— Command and Scripting InterpreterT1083— File and Directory DiscoveryT1552.001— Credentials In FilesT1059.004— Unix ShellT1078— Valid AccountsT1068— Exploitation for Privilege EscalationT1027— Obfuscated Files or InformationT1027.002— Software PackingT1071.001— Web ProtocolsT1136— Create AccountT1018— Remote System DiscoveryT1046— Network Service Discovery
🤖 AI Attribution
Generated by
2,343 input / 2,291 output tokens ·
Reviewed and approved by a human analyst before publication
Generated by
gemini-2.5-flash ·2,343 input / 2,291 output tokens ·
Reviewed and approved by a human analyst before publication