{"uuid": "19afcb3a-1eb9-4286-b9e3-6007061e33cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63030", "type": "seen", "source": "https://gist.github.com/alon710/8bb76681f888e7031338e0a8853407f6", "content": "# CVE-2026-60137: CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter\n\n> **CVSS Score:** 5.9\n> **Published:** 2026-07-17\n> **Full Report:** https://cvereports.com/reports/CVE-2026-60137\n\n## Summary\nCVE-2026-60137 is a critical SQL injection vulnerability in the Core component of WordPress. The flaw occurs within the WP_Query class during the processing of the author__not_in parameter, where user-supplied array inputs are constructed into a SQL string without strict integer type-casting. When chained with CVE-2026-63030, an unauthenticated remote attacker can exploit this SQL injection to read database values, extract administrator credential hashes, or modify administrative options to execute arbitrary PHP code on the server.\n\n## TL;DR\nWordPress Core contains an SQL injection vulnerability in the WP_Query class when parsing author__not_in parameters. When chained with CVE-2026-63030, unauthenticated attackers can execute arbitrary SQL and escalate privileges to Remote Code Execution.\n\n## Exploit Status: ACTIVE\n\n## Technical Details\n\n- **CWE ID**: CWE-89\n- **Attack Vector**: Network\n- **CVSS Base Score**: 5.9 (Standalone) / 9.8 (Chained)\n- **Exploit Status**: active\n- **CISA KEV Status**: Listed\n- **EPSS Score**: 0.78305\n\n## Affected Systems\n\n- WordPress Core 6.8.0 through 6.8.5\n- WordPress Core 6.9.0 through 6.9.4\n- WordPress Core 7.0.0 through 7.0.1\n- **WordPress Core**: >= 6.8.0, < 6.8.6 (Fixed in: `6.8.6`)\n- **WordPress Core**: >= 6.9.0, < 6.9.5 (Fixed in: `6.9.5`)\n- **WordPress Core**: >= 7.0.0, < 7.0.2 (Fixed in: `7.0.2`)\n\n## Mitigation\n\n- Upgrade WordPress Core immediately to a patched version\n- Disable or block unauthorized access to the REST API batch routes\n- Implement restrictive WAF rules to detect nested array manipulations in REST requests\n\n**Remediation Steps:**\n1. Access the administrative control panel of the WordPress installation.\n2. Navigate to the Updates section and select Update Now to apply the latest security version.\n3. For headless or automated deployments, update the composer.json or version lockfiles to reference 6.8.6, 6.9.5, or 7.0.2.\n4. Configure the Web Application Firewall to block POST requests directed at /wp-json/batch/v1 and /?rest_route=/batch/v1.\n\n## References\n\n- [WordPress Core Advisory (GHSA-fpp7-x2x2-2mjf)](https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf)\n- [WordPress 7.0.2 Security Release](https://wordpress.org/news/2026/07/wordpress-7-0-2-release/)\n- [CISA KEV Catalog Reference](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137)\n- [Searchlight Cyber Research on wp2shell](https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core)\n- [Aikido Security Blog Analysis](https://www.aikido.dev/blog/unauthenticated-rce-in-wordpress-wp2shell)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-60137) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T13:01:54.482183Z"}