SQL injection in WordPress - CVE-2026-60137
Published: July 22, 2026 / Updated: September 4, 2026
Vulnerability identifier: #VU139076
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-60137
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data passed via the "author__not_in" parameter of WP_Query. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
WordPress
Debian Linux
wordpress (Debian package)
Debian Linux
wordpress (Debian package)
How to mitigate CVE-2026-60137
Install updates from vendor's website.
WordPress - addressed in versions 6.8.6, 6.9.5, 7.0.2
wordpress (Debian package) - update to 6.8.6+dfsg1-0+deb13u1
wordpress (Debian package) - update to 6.8.6+dfsg1-0+deb13u1
Links to Public Exploits and PoC-codes
- Exploit #13056 - WordPresShell (September 4, 2026)
- Exploit #12975 - WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion (August 25, 2026)
- Exploit #12954 - wp2shell-Exploit-Waf-Bypass (Exploit WordPress pre-auth RCE vulnerabilities with automated WAF bypass to gain unauthenticated shell access.) (August 21, 2026)
- Exploit #12917 - wp2shell-Exploit-Waf-Bypass (WordPress Pre-Auth RCE Exploit + Scanner + WAF Bypass | CVE-2026-63030 + CVE-2026-60137 | Go + Python + Metasploit modules + Docker lab) (August 14, 2026)
- Exploit #12913 - WP2Shell (WP2Shell is a powerful and modular exploit framework that combines two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to achieve complete compromise of a target site without any credentials. ) (August 14, 2026)
- Exploit #12885 - WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE (August 7, 2026)
- Exploit #12877 - CVE-2026-60137-WordPress-Core-SQL-Injection-PoC (Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parameter.) (August 6, 2026)