Skip to content

Security Sense

AI Threat Intelligence

  • About
  • Blog
  • Privacy Policy

Tag: sql injection

CVE-2026-114625: Critical SQL Injection in Arista VeloCloud Orchestrator

Posted on November 3, 2026 by Kyle

Overview

CVE-2026-114625 is a critical SQL injection vulnerability affecting Arista VeloCloud Orchestrator (VCO) on-prem deployments. This flaw allows any authenticated user to escalate privileges to a “superuser operator,” accessing internal functionality not intended for remote exposure. The vulnerability is actively being exploited, posing a severe risk to the confidentiality, integrity, and availability of affected systems.

Technical Analysis

  • Vulnerability: SQL Injection (CWE-89).
  • Impact: Allows authenticated users to gain “superuser operator” privileges, access privileged internal functionality, and compromise confidentiality, integrity, and availability of the VCO host and managed data.
  • Attack Vector: Remote, authenticated user (CVSS AV:N, PR:L).
  • Affected Products (on-prem only):
    • Arista VeloCloud Orchestrator versions >= 5.2.0 < 5.2.3.18
    • Arista VeloCloud Orchestrator versions >= 6.1.0 < 6.1.3.10
    • Arista VeloCloud Orchestrator versions >= 6.4.0 < 6.4.2.12
  • CVSS 3.1 Score: 9.9 (CRITICAL) – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
  • Note: Hosted and Dedicated versions of VCO were impacted but have already been patched by Arista.

Detection

  • Monitor web server access logs for unusual requests containing SQL injection payloads (e.g., UNION SELECT, SLEEP(), WAITFOR DELAY, ' OR 1=1 --).
  • Look for repeated authentication attempts or successful logins followed by rapid privilege escalation or access to unusual administrative endpoints.
  • Analyze application logs for SQL errors or unexpected database query executions, especially from authenticated user sessions.
  • Monitor for changes in user privileges or the creation of new highly privileged accounts within the VeloCloud Orchestrator.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

VeloCloud Orchestrator – SQL Injection Pattern in URI

title: VeloCloud Orchestrator - SQL Injection Pattern in URI
id: 9a2b1c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects common SQL injection patterns within the URI or query parameters of web requests, potentially targeting Arista VeloCloud Orchestrator.
logsource:
  category: webserver
detection:
  selection_keywords:
    cs-uri-query|contains:
      - 'union select'
      - 'sleep('
      - 'waitfor delay'
      - ''' or ''1''=''1'
      - 'information_schema'
      - 'pg_sleep('
      - 'benchmark('
      - 'xp_cmdshell'
    cs-uri-stem|contains:
      - 'union select'
      - 'sleep('
      - 'waitfor delay'
      - ''' or ''1''='
      - 'information_schema'
      - 'pg_sleep('
      - 'benchmark('
      - 'xp_cmdshell'
  condition: selection_keywords
level: high

Mitigations

  1. Immediately apply available security patches from Arista. Refer to Arista Security Advisory 24838-security-advisory-0199 for specific versions.
    • For 5.2.x series, upgrade to 5.2.3.18 or later.
    • For 6.1.x series, upgrade to 6.1.3.10 or later.
    • For 6.4.x series, upgrade to 6.4.2.12 or later.
  2. Implement robust input validation and parameterized queries for all user-supplied input to prevent SQL injection.
  3. Enforce the principle of least privilege for all users, especially those with access to the VCO interface.
  4. Regularly review and audit user accounts and their assigned privileges within the VeloCloud Orchestrator.
  5. Deploy a Web Application Firewall (WAF) to help detect and block common SQL injection attack patterns.

References

  • https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199
  • https://nvd.nist.gov/vuln/detail/CVE-2026-114625
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-114625

Indicators of Compromise

Type Value Description
IP Address 38.54.50.151 Potential malicious IP identified as an indicator of compromise (via https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)
IP Address 74.82.197.86 Potential malicious IP identified as an indicator of compromise (via https://www.arista.com/en/support/advisories-notices/security-advisory/24838-security-advisory-0199)

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1078.003 — Local Accounts
  • T1133 — External Remote Services
  • T1082 — System Information Discovery
  • T1071 — Application Layer Protocol
  • T1595.002 — Vulnerability Scanning
  • T1505.003 — Web Shell
  • T1548 — Abuse Elevation Control Mechanism
  • T1210 — Exploitation of Remote Services
  • T1098 — Account Manipulation
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,135 input / 1,391 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged active exploitation, arista, critical, sql injection, velocloud orchestrator, vulnerability, zero-dayLeave a comment

WordPress Core SQL Injection (CVE-2026-60137) Chained for RCE

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-60137 is a SQL injection vulnerability affecting WordPress Core. While rated Medium severity on its own, it is critical because it can be chained with CVE-2026-63030 to enable unauthenticated remote code execution (RCE). This vulnerability is actively exploited, making immediate patching crucial for all WordPress administrators.

Technical Analysis

The vulnerability resides in the WP_Query component of WordPress Core, specifically in how it handles the author__not_in parameter. WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize untrusted input passed to this parameter by a plugin or theme. This allows an attacker to inject arbitrary SQL queries.

  • Vulnerability Type: SQL Injection (CWE-89)
  • Affected Versions:
    • WordPress >= 6.8, < 6.8.6
    • WordPress >= 6.9, < 6.9.5
    • WordPress >= 7.0, < 7.0.2
  • Prerequisites: A plugin or theme must pass untrusted input to the author__not_in parameter of WP_Query.
  • Attack Vector: Network (CVSS:3.1/AV:N)
  • Impact: High confidentiality impact (CVSS:3.1/C:H), no integrity or availability impact on its own. When chained with CVE-2026-63030, it leads to RCE.
  • CVSS 3.1 Score: 5.9 (MEDIUM)

Detection

  • Web Server Logs: Monitor web server access logs (e.g., Apache, Nginx, IIS) for requests containing author__not_in= in the URI or POST body, especially when combined with common SQL injection payloads such as UNION SELECT, ' OR 1=1--, SLEEP(), or LOAD_FILE(). Look for unusual HTTP status codes or response sizes following such requests.
  • Process Monitoring: On web servers, monitor for the web server process (e.g., httpd.exe, nginx.exe, php-fpm.exe, w3wp.exe) spawning unusual child processes, particularly command shells (cmd.exe, powershell.exe, sh, bash) or scripting interpreters, which could indicate successful RCE.
  • File Integrity Monitoring (FIM): Implement FIM on WordPress installation directories. Alert on the creation or modification of new .php files in web-accessible directories (wp-content, wp-includes, plugin/theme directories), as this could indicate a webshell drop.
  • Network Traffic Analysis: Look for outbound connections initiated by the web server process to unusual or known malicious IP addresses/domains, which might indicate command-and-control (C2) communication or data exfiltration post-exploitation.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress Core SQL Injection CVE-2026-60137 Attempt

title: WordPress Core SQL Injection CVE-2026-60137 Attempt
id: 9029a1b8-20d0-482a-97a6-407133f93282
status: experimental
description: Detects attempts to exploit CVE-2026-60137, a SQL injection vulnerability in WordPress Core's WP_Query author__not_in parameter.
logsource:
  category: webserver
detection:
  selection_uri:
    - cs-uri-query|contains: 'author__not_in='
    - c-uri|contains: 'author__not_in='
  selection_sqli_patterns:
    - cs-uri-query|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
    - c-uri|contains:
        - ' UNION SELECT '
        - ' OR 1=1-- '
        - ' AND 1=1-- '
        - ' SLEEP('
        - ' WAITFOR DELAY '
        - ' LOAD_FILE('
        - ' CONCAT('
  condition: selection_uri and selection_sqli_patterns
level: high

Web Server Process Spawning Suspicious Shell (Windows)

title: Web Server Process Spawning Suspicious Shell (Windows)
id: 4b27f67d-93d3-4a11-a81d-66f688820c7a
status: experimental
description: Detects a web server process spawning a command shell, indicative of successful remote code execution, potentially via CVE-2026-60137 chaining.
logsource:
  product: windows
  service: sysmon
detection:
  selection_parent:
    ParentImage|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_parent and selection_child
level: critical

Web Server Process Creating Suspicious PHP File (Windows)

title: Web Server Process Creating Suspicious PHP File (Windows)
id: 7e7f8e1a-5b0c-4d3e-8f9a-2c1d0e6f7b8c
status: experimental
description: Detects a web server process creating a new PHP file in a web-accessible directory, which could indicate a webshell drop after successful exploitation.
logsource:
  product: windows
  service: sysmon
  definition: 'Requires Sysmon EventID 11 (FileCreate) to be enabled.'
detection:
  selection_process:
    Image|endswith:
      - '\php-fpm.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\w3wp.exe'
  selection_file:
    TargetFilename|endswith: '.php'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-content\plugins\'
      - '\wp-content\themes\'
      - '\html\'
      - '\www\'
  condition: selection_process and selection_file
level: high

Mitigations

  1. Patch Immediately: Update all affected WordPress installations to the latest patched versions: 6.8.6, 6.9.5, 7.0.2, or newer. This is the most critical step to prevent exploitation.
  2. Web Application Firewall (WAF): Deploy and configure a WAF to detect and block common SQL injection patterns, specifically targeting the author__not_in parameter in WordPress requests. Ensure rules are updated to cover known exploitation patterns for this CVE.
  3. Review Plugins and Themes: Audit all third-party and custom WordPress plugins and themes. Prioritize those that interact with WP_Query or user-supplied input for author__not_in to ensure proper input sanitization and validation are in place.
  4. Principle of Least Privilege: Ensure the web server process and its associated PHP processes run with the minimum necessary privileges to limit the impact of successful exploitation.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-60137
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1059.004 — Unix Shell
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,343 input / 2,291 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged actively exploited, cve-2026-60137, cve-2026-63030, medium, pre-authentication, rce, sql injection, vulnerability, webshell, wordpressLeave a comment

CVE-2026-63030: WordPress REST API RCE via Chained SQL Injection

Posted on July 25, 2026 - September 27, 2026 by Kyle

Overview

CVE-2026-63030 is a critical vulnerability affecting WordPress Core, specifically its REST API batch endpoint. This flaw, when combined with a separate SQL Injection vulnerability (CVE-2026-60137), enables unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations. Given its CVSS score of 9.8 and confirmed active exploitation, immediate patching is essential for all affected WordPress sites.

Technical Analysis

  • Vulnerability Type: Interpretation Conflict (CWE-436) leading to SQL Injection and Remote Code Execution.
  • Affected Versions:
    • WordPress versions 6.9.x before 6.9.5
    • WordPress versions 7.0.x before 7.0.2
  • Attack Vector: Network (AV:N), Low Attack Complexity (AC:L), No Privileges Required (PR:N), No User Interaction (UI:N). CVSS 3.1 Base Score: 9.8 (CRITICAL).
  • Mechanism: The vulnerability chain involves two distinct issues:
    1. CVE-2026-63030: A REST API batch endpoint route confusion issue. This allows an attacker to manipulate how the batch endpoint processes requests.
    2. CVE-2026-60137: An author__not_in WP_Query SQL Injection. This SQLi can be triggered through the confused batch endpoint.
  • Exploitation: An unauthenticated attacker can leverage the route confusion to inject malicious SQL queries via the author__not_in parameter. This SQL injection can then be escalated to achieve Remote Code Execution, potentially leading to webshell deployment or direct command execution. Tools like CMSmap have been linked to exploitation attempts.

Detection

  • Web Server Logs: Monitor web server access logs for unusual requests to WordPress REST API batch endpoints, specifically wp-json/batch/v1/ or similar paths, containing suspicious parameters (e.g., author__not_in) or large, malformed POST bodies.
  • Process Creation: Look for unexpected child processes spawned by the web server process (e.g., httpd, nginx, w3wp.exe, php-cgi.exe). Specifically, monitor for cmd.exe, powershell.exe, sh, or bash being executed.
  • File System Monitoring: Detect creation of suspicious files (e.g., .php, .asp, .jsp files) in WordPress web root directories, particularly wp-content/uploads/ or wp-includes/, by the web server process. These could indicate webshell deployment.
  • Database Logs: If available, monitor database logs for unusual or malformed SQL queries, especially those targeting user or option tables, originating from the WordPress application.

Sigma Detection Rules

⚠️ AI-generated detection rules. These are experimental starting points. Review field names, EventIDs, and logic against your environment’s schema before deploying. Tune to reduce false positives.

WordPress REST API Batch Endpoint Suspicious Request

title: WordPress REST API Batch Endpoint Suspicious Request
id: 9283e01a-f1c2-4a7b-a1c3-2d4e5f6g7h8i
status: experimental
description: Detects suspicious requests to the WordPress REST API batch endpoint, potentially indicating exploitation attempts for CVE-2026-63030 chained with CVE-2026-60137.
logsource:
  category: webserver
detection:
  selection:
    cs-uri-stem|contains: '/wp-json/batch/v1/'
    cs-method: ['POST', 'PUT']
    c-uri|contains: 'author__not_in'
  condition: selection
level: high

Web Server Spawning Shell Process

title: Web Server Spawning Shell Process
id: a1b2c3d4-e5f6-7890-1234-567890abcdef
status: experimental
description: Detects a web server process spawning a shell interpreter, indicative of successful Remote Code Execution (RCE).
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    ParentImage|endswith: 
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\sh.exe'
      - '\bash.exe'
      - '\pwsh.exe'
  condition: selection
level: critical

Web Server Creating Suspicious File in WordPress Directories

title: Web Server Creating Suspicious File in WordPress Directories
id: f0e9d8c7-b6a5-4321-fedc-ba9876543210
status: experimental
description: Detects a web server process creating suspicious files (e.g., webshells) in common WordPress upload or include directories, a common post-exploitation activity.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    EventID: 11
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\php-cgi.exe'
      - '\apache.exe'
    TargetFilename|contains:
      - '\wp-content\uploads\'
      - '\wp-includes\'
    TargetFilename|endswith:
      - '.php'
      - '.php5'
      - '.phtml'
      - '.asp'
      - '.aspx'
      - '.jsp'
      - '.jspx'
  condition: selection
level: high

Mitigations

  1. Patch Immediately: Upgrade WordPress to version 6.9.5 or 7.0.2, or later, as soon as possible. These versions contain the necessary fixes for both CVE-2026-63030 and CVE-2026-60137.
  2. Restrict REST API Access: If feasible and not critical for site functionality, consider limiting access to the WordPress REST API endpoint (/wp-json/) at the web server or WAF level, especially for unauthenticated users.
  3. Implement Web Application Firewall (WAF): Deploy and configure a WAF to detect and block known SQL injection patterns and suspicious requests targeting WordPress REST API endpoints.
  4. Principle of Least Privilege: Ensure the web server process runs with the minimum necessary privileges to limit the impact of successful exploitation.
  5. Regular Backups: Maintain regular, tested backups of WordPress sites and databases to facilitate recovery in case of compromise.

References

  • https://nvd.nist.gov/vuln/detail/CVE-2026-63030
  • https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-ff9f-jf42-662q
  • https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
  • https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-63030
  • https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

  • T1190 — Exploit Public-Facing Application
  • T1505.003 — Web Shell
  • T1059.003 — Windows Command Shell
  • T1059.004 — Unix Shell
  • T1140 — Deobfuscate/Decode Files or Information
  • T1087 — Account Discovery
  • T1059 — Command and Scripting Interpreter
  • T1083 — File and Directory Discovery
  • T1552.001 — Credentials In Files
  • T1078 — Valid Accounts
  • T1068 — Exploitation for Privilege Escalation
  • T1027 — Obfuscated Files or Information
  • T1027.002 — Software Packing
  • T1071.001 — Web Protocols
  • T1136 — Create Account
  • T1018 — Remote System Discovery
  • T1046 — Network Service Discovery
🤖 AI Attribution
Generated by gemini-2.5-flash ·
2,319 input / 2,116 output tokens ·
Reviewed and approved by a human analyst before publication
Posted in vulnerabilityTagged batch api exploitation, cmsmap, critical, cve-2026-60137, cve-2026-63030, pre-authentication, rce, sql injection, vulnerability, webshell, wordpressLeave a comment
Proudly powered by WordPress | Theme: micro, developed by DevriX.