DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-60137: CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter

#security #cve #cybersecurity

CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter

Vulnerability ID: CVE-2026-60137
CVSS Score: 5.9
Published: 2026-07-17

CVE-2026-60137 is a critical SQL injection vulnerability in the Core component of WordPress. The flaw occurs within the WP_Query class during the processing of the author__not_in parameter, where user-supplied array inputs are constructed into a SQL string without strict integer type-casting. When chained with CVE-2026-63030, an unauthenticated remote attacker can exploit this SQL injection to read database values, extract administrator credential hashes, or modify administrative options to execute arbitrary PHP code on the server.

TL;DR

WordPress Core contains an SQL injection vulnerability in the WP_Query class when parsing author__not_in parameters. When chained with CVE-2026-63030, unauthenticated attackers can execute arbitrary SQL and escalate privileges to Remote Code Execution.

⚠️ Exploit Status: ACTIVE

Technical Details

  • CWE ID: CWE-89
  • Attack Vector: Network
  • CVSS Base Score: 5.9 (Standalone) / 9.8 (Chained)
  • Exploit Status: active
  • CISA KEV Status: Listed
  • EPSS Score: 0.78305

Affected Systems

  • WordPress Core 6.8.0 through 6.8.5
  • WordPress Core 6.9.0 through 6.9.4
  • WordPress Core 7.0.0 through 7.0.1
  • WordPress Core: >= 6.8.0, < 6.8.6 (Fixed in: 6.8.6)
  • WordPress Core: >= 6.9.0, < 6.9.5 (Fixed in: 6.9.5)
  • WordPress Core: >= 7.0.0, < 7.0.2 (Fixed in: 7.0.2)

Exploit Details

  • wp2shell-PoC by sowarma: Unauthenticated RCE exploit chain combining REST API batch route confusion with the SQLi.
  • wp2shell-poc by Icex0: Full RCE chain demonstrating the unauthenticated exploitation mechanism.
  • wp2shell by 0xsha: Unauthenticated RCE toolkit for testing and demonstrating vulnerability on vulnerable installations.
  • wp2shell-scanner by ZephrFish: Mass scanner specifically engineered to locate vulnerable REST batch route handlers and underlying SQLi states.
  • wp2shell-lab by dinosn: Docker-based local reproduction lab environment and safe detection script for WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1.
  • WordPresShell by securelayer7: Educational exploit proof-of-concept for internal corporate testing.

Mitigation Strategies

  • Upgrade WordPress Core immediately to a patched version
  • Disable or block unauthorized access to the REST API batch routes
  • Implement restrictive WAF rules to detect nested array manipulations in REST requests

Remediation Steps:

  1. Access the administrative control panel of the WordPress installation.
  2. Navigate to the Updates section and select Update Now to apply the latest security version.
  3. For headless or automated deployments, update the composer.json or version lockfiles to reference 6.8.6, 6.9.5, or 7.0.2.
  4. Configure the Web Application Firewall to block POST requests directed at /wp-json/batch/v1 and /?rest_route=/batch/v1.

References

Read the full report for CVE-2026-60137 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)