CVE-2026-60137 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-17

Added to CISA KEV: 2026-07-21 4 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review web/access logs for anomalous author__not_in parameters and REST Batch API abuse, check for web shells/unauthorized plugins, audit database for tampering, and verify file/system integrity.
Immediately update WordPress to 6.8.6, 6.9.5, 7.0.2, or later. WordPress core auto-updates should be verified as applied.
If patching cannot be done immediately, disable the WordPress REST Batch API if not required and deploy WAF rules to block malicious author__not_in payloads; audit plugins/themes passing untrusted input to WP_Query.
Monitor for post-exploitation activity (new admin users, unexpected file writes, outbound C2), and rotate secrets/credentials if compromise is suspected. Patch priority: EMERGENCY / IMMEDIATE.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-60137 is a critical SQL injection vulnerability within WordPress core caused by the improper sanitization of the `author__not_in` parameter in `WP_Query` ^[4]^[5]. This flaw is highly significant because it can be chained with other vulnerabilities, such as CVE-2026-63030, to achieve unauthenticated remote code execution (RCE) on default WordPress installations, posing a severe risk to the vast number of WordPress sites globally ^[1]^[3].

Exploitation

Active Exploitation: The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog, confirming that it has been exploited in the wild ^[2]^[7].
Threat Actors: While specific threat actors are not always publicly named, the high exploitation probability and inclusion in the KEV catalog indicate significant interest from malicious entities ^[2].
PoC/Exploit Tools: Publicly available proof-of-concept (PoC) scripts and verification tools exist, such as those documenting the "wp2shell" RCE chain ^[3]^[6].
Attack Prerequisites: This is a remote, unauthenticated vulnerability reachable via crafted HTTP requests, particularly when targeting the WordPress REST Batch API; no user interaction or local authentication is required ^[1]^[2].

Affected Products & Patches

Affected Versions:

- WordPress 6.8.x before 6.8.6 - WordPress 6.9.x before 6.9.5 - WordPress 7.0.x before 7.0.2

Patches: Patches are available in the updated versions (6.8.6, 6.9.5, 7.0.2, and later) which implement the necessary sanitization for the `author__not_in` parameter ^[4]^[5].
Mitigations: Administrators are urged to update to the latest patched versions immediately. For those unable to patch, disabling the WordPress REST Batch API if not required can reduce the attack surface ^[1].

Impact

Exploitation Capability: Successful exploitation allows for SQL injection, which can lead to unauthorized data exfiltration and, when chained with other vulnerabilities (e.g., CVE-2026-63030), can facilitate full remote code execution on the server ^[3]^[4].
Business Risk: Internet-facing WordPress deployments are at extreme risk. Given the ease of exploitation, an unpatched instance can be fully compromised by remote attackers, leading to total loss of site control, data breaches, and potential integration into botnets ^[1]^[2].

Sources

CVE-2026-63030 and CVE-2026-60137: Mitigating a ...
The vulnerability chain affects WordPress Core installations that expose the REST batch API in a default configuration. Administrators should ... Researchers have revealed details regarding a critical vulnerability chain that impacts WordPress Core. The issue, tracked as CVE-2026-63030 and CVE-2026-…
CVE-2026-60137 - Vulnerability Details - OpenCVE
The vulnerability is listed in CISA’s KEV catalog. The likely attack vector is remote, achieved through a crafted HTTP request that exploits a plugin or theme’s use of author__not_in. Generated by OpenCVE AI on August 25, 2026 at 15:22 UTC. ... CVE-2026-60137 - WordPress < 7.0.2 - Facilitated SQL In…
WP2Shell Vulnerabilities: CVE-2026-60137 and ...
Two new WordPress core vulnerabilities were disclosed on July 17, prompting broad concern from the security community. CVE-2026-60137 and ... CVE-2026-60137 and CVE-2026-63030 are able to be chained for remote code execution against out-of-the-box WordPress installations, with multiple paths to RCE…
CVE-2026-60137 WordPress Core SQL Injection| Fidelis Security
CVE-2026-60137 is a critical SQL injection vulnerability in WordPress caused by improper sanitization of the author__not_in parameter in WP_Query. It affects WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2.Which Systems Are Vulnerable to CVE-2026-60137? Technical Overview. V…
NVD-CVE-2026-60137 - National Vulnerability Database
Description. WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in ...

🔴 CVE-2026-60137