{"id":"CVE-2026-60137","aliases":["BIT-wordpress-2026-60137","BIT-wordpress-multisite-2026-60137","DEBIAN-CVE-2026-60137","EUVD-2026-45279","GHSA-fpp7-x2x2-2mjf","UBUNTU-CVE-2026-60137"],"status":"published","title":"WordPress \u003c 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","severity":{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.05323,"percentile":0.92663,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-89"],"published":"2026-07-17T19:14:12Z","modified":"2026-11-07T02:56:00Z","kev":{"date_added":"2026-07-21","due_date":"2026-08-04","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-07-21"},{"source":"kev","since":"2026-07-21"}],"exploits":[{"source":"metasploit","id":"exploit/multi/http/wp_batch_desync_rce","title":"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","type":"exploit","platform":"Linux,PHP,Unix","date":"2026-07-17","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/wp_batch_desync_rce"},{"source":"pocgithub","id":"codeb0ssx/Ultimate-wp2shell","title":"codeb0ssx/Ultimate-wp2shell","date":"2026-07-18","url":"https://github.com/codeb0ssx/Ultimate-wp2shell"},{"source":"pocgithub","id":"h4cd0c/wp2shell","title":"h4cd0c/wp2shell","date":"2026-07-18","url":"https://github.com/h4cd0c/wp2shell"},{"source":"pocgithub","id":"Colere-Sys/wp2shell-poc","title":"Colere-Sys/wp2shell-poc","date":"2026-07-21","url":"https://github.com/Colere-Sys/wp2shell-poc"},{"source":"pocgithub","id":"mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","title":"mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","date":"2026-07-21","url":"https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress"},{"source":"pocgithub","id":"northsia/CVE-2026-60137-With-Skip-SSL","title":"northsia/CVE-2026-60137-With-Skip-SSL","date":"2026-07-26","url":"https://github.com/northsia/CVE-2026-60137-With-Skip-SSL"},{"source":"pocgithub","id":"Dungsocool/CVE-2026-60137_CVE-2026-63030","title":"Dungsocool/CVE-2026-60137_CVE-2026-63030","date":"2026-07-27","url":"https://github.com/Dungsocool/CVE-2026-60137_CVE-2026-63030"},{"source":"pocgithub","id":"michael-kanda/Wp2shell-ioc-scanner","title":"michael-kanda/Wp2shell-ioc-scanner","date":"2026-08-01","url":"https://github.com/michael-kanda/Wp2shell-ioc-scanner"},{"source":"pocgithub","id":"AdarshThakur14777-cyber/CVE-2026-60137","title":"AdarshThakur14777-cyber/CVE-2026-60137","date":"2026-08-03","url":"https://github.com/AdarshThakur14777-cyber/CVE-2026-60137"},{"source":"pocgithub","id":"AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC","title":"AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC","date":"2026-08-05","url":"https://github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC"},{"source":"pocgithub","id":"ivanesk315/CVE-2026-60137-and-CVE-2026-63030","title":"ivanesk315/CVE-2026-60137-and-CVE-2026-63030","date":"2026-09-10","url":"https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030"},{"source":"metasploit","id":"auxiliary/scanner/http/wordpress_wp2shell_sqli","title":"WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion","type":"auxiliary","date":"2026-07-17","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_wp2shell_sqli"}],"fixes":[{"ecosystem":"Bitnami","package":"wordpress","fixed_in":["6.8.6","6.9.5","7.0.2"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"wordpress-multisite","fixed_in":["6.8.6","6.9.5","7.0.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wordpress","fixed_in":["6.8.6+dfsg1-0+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wordpress","fixed_in":["7.0.2+dfsg1-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"wordpress","ranges":[{"type":"SEMVER","events":[{"introduced":"6.8.0"},{"fixed":"6.8.6"},{"introduced":"6.9.0"},{"fixed":"6.9.5"},{"introduced":"7.0.0"},{"fixed":"7.0.2"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"wordpress-multisite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.8.0"},{"fixed":"6.8.6"},{"introduced":"6.9.0"},{"fixed":"6.9.5"},{"introduced":"7.0.0"},{"fixed":"7.0.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8.6+dfsg1-0+deb13u1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-0+deb13u1","6.8.3+dfsg1-1"]},{"source":"osv","ecosystem":"Debian:14","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.2+dfsg1-1"}]}],"versions":["6.8.1+dfsg1-1","6.8.3+dfsg1-1","6.9+dfsg1-1","6.9.4+dfsg1-1","7.0+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.3+dfsg-1","4.3.1+dfsg-1","4.4+dfsg-1","4.4.1+dfsg-1","4.4.2+dfsg-1","4.4.2+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.2+dfsg-2","4.8.3+dfsg-1","4.9.1+dfsg-1","4.9.2+dfsg-1","4.9.4+dfsg-1","4.9.5+dfsg1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.2.2+dfsg1-1","5.2.4+dfsg1-1","5.3.2+dfsg1-1","5.3.2+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.7.1+dfsg1-2ubuntu1","5.8.1+dfsg1-2ubuntu1","5.8.2+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1","5.8.3+dfsg1-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2+dfsg1-1ubuntu1","6.4.3+dfsg1-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"wordpress","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.7.2+dfsg1-1.1ubuntu1","6.7.2+dfsg1-1.1ubuntu2"]}],"products":[{"vendor":"wordpress","product":"core"},{"vendor":"wordpress","product":"wordpress"},{"vendor":"wordpress foundation","product":"wordpress"}],"references":[{"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf","tags":["vdb-entry","technical-description","Vendor Advisory","advisory","report"]},{"url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/","tags":["release-notes","vendor-advisory","Release Notes","article","advisory","report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60137","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/60xxx/CVE-2026-60137.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-60137","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-60137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-60137","tags":["report"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/74d37a344cbf28e9187a1a5ca71b33d186bcd333","tags":["report"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/6f2074dda61864a03f334d70414d1690ce7e5c79","tags":["report"]},{"url":"https://github.com/WordPress/wordpress-develop/commit/c62f8c47314727184124b1227a00ee2eef546231","tags":["report"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-60137","title":"WordPress \u003c 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-17T19:14:12.159Z","modified":"2026-10-07T18:16:21.04Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:49:31.546614Z"}],"euvd":[{"id":"EUVD-2026-45279","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-17T19:14:12Z","modified":"2026-10-07T18:16:21Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"exploited_since":"2026-07-21","updated_at":"2026-11-02T17:27:34.353796Z"}],"kev":[{"id":"CVE-2026-60137","title":"WordPress Core SQL Injection Vulnerability","description":"WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","cwes":["CWE-89"],"kev":{"date_added":"2026-07-21","due_date":"2026-08-04","required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-60137","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-17T20:17:27.79Z","modified":"2026-10-08T10:35:47.777Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:30.631352Z"}],"osv":[{"id":"CVE-2026-60137","title":"WordPress \u003c 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-17T19:14:12.159Z","modified":"2026-11-08T02:47:39.250989239Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-07T03:08:08.148548Z"},{"id":"DEBIAN-CVE-2026-60137","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-17T20:17:27.79Z","modified":"2026-10-09T09:47:34.756205883Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:57.932517Z"},{"id":"UBUNTU-CVE-2026-60137","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-17T20:17:00Z","modified":"2026-10-17T13:00:30.992616031Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"BIT-wordpress-2026-60137","title":"WordPress \u003c 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-27T05:55:53.343Z","modified":"2026-11-07T02:56:00.28056497Z","updated_at":"2026-11-07T03:05:28.577678Z"},{"id":"BIT-wordpress-multisite-2026-60137","title":"WordPress \u003c 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","description":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","status":"published","published":"2026-07-27T05:55:57.511Z","modified":"2026-11-07T02:56:00.28056497Z","updated_at":"2026-11-07T03:05:28.577678Z"}]}}