CVE-2026-60137

What is WordPress Core?

WordPress powers roughly 40% of all websites, making its core codebase — independent of any theme or plugin — one of the highest-impact single targets in web security. A vulnerability in WordPress Core itself, rather than in third-party plugin code, is comparatively rare and immediately affects every default installation running an unpatched version, regardless of which plugins or themes are in use.

Overview

CVE-2026-60137 is a SQL injection vulnerability (CWE-89) in WordPress Core's WP_Query class, present since WordPress 6.8. On its own it requires reaching an internal code path not normally exposed to unauthenticated users (reflected in its "High" attack complexity and CVSS 5.9 Medium score). It becomes far more dangerous when chained with CVE-2026-63030, a request-routing "interpretation conflict" bug that lets an unauthenticated attacker reach the vulnerable query path directly — together the two form an unauthenticated remote code execution chain that researchers have nicknamed "wp2shell." Both were disclosed July 17, 2026 and fixed in WordPress 7.0.2 (and backported to 6.8.6 / 6.9.5), with public proof-of-concept exploits appearing within hours and confirmed in-the-wild exploitation within days.

Affected Versions

Sites on the 6.8.x branch are affected only by the SQL injection (CVE-2026-60137), since the routing confusion in CVE-2026-63030 was introduced later, in 6.9. The vulnerable path is specifically noted as reachable "when a persistent object cache is not in use," which is the default configuration for most WordPress installations.

Technical Details

The SQL injection lies in how WP_Query builds a query using the author__not_in parameter, constructing SQL from insufficiently sanitized input. In isolation this parameter is not normally reachable by an unauthenticated visitor. The companion bug, CVE-2026-63030 (CWE-436, "interpretation conflict"), is a logic flaw in the REST API batch request processor (WP_REST_Server::serve_batch_request_v1() at /wp-json/batch/v1): the handler validates and dispatches batched sub-requests using two separate internal arrays, and when wp_parse_url() fails on a malformed sub-request path, the resulting error is recorded only in the validation array, desynchronizing it from the dispatch array. That desync causes subsequent batched sub-requests in the same call to be routed to the wrong handler — exactly the kind of access-path confusion that lets an unauthenticated attacker reach the otherwise-gated WP_Query code path and trigger the SQL injection, chaining the two into unauthenticated RCE on default installations (CVSS 3.1 for the chain effectively reaching 9.8 Critical, reflected in CVE-2026-63030's own score).

Discovery

CVE-2026-63030 (the routing/interpretation-conflict half of the chain) was discovered by Adam Kues of Searchlight Cyber, who deliberately withheld exploit specifics at the initial July 17 disclosure given the severity, publishing a full technical breakdown on July 20. CVE-2026-60137 (the SQL injection) was reported by researchers TF1T, dtro, and haongo. Kues was quoted noting that "no security researcher could have found and completed this exploit chain in 10 hours without AI," referring to the speed at which a working public exploit was assembled after disclosure.

Exploitation Context

Public proof-of-concept code appeared on GitHub within hours of the July 17, 2026 disclosure. Multiple security firms — Tenable, Rapid7, Akamai, NetSPI, and CyCognito among them — confirmed in-the-wild exploitation via honeypot telemetry by July 20, 2026. Cloudflare shipped dedicated WAF rules for the pair given the scale of potentially affected sites. CISA added both CVEs to KEV on July 21, 2026, but with notably different deadlines: CVE-2026-63030 (and the chain overall) got a four-day window to July 24, while this CVE (CVE-2026-60137) was given until August 4 — an unusual asymmetry for two vulnerabilities that are only dangerous when exploited together, worth noting when prioritizing remediation (patch both at once regardless of the deadline gap).

Remediation

1. Update to WordPress 7.0.2 (or 6.8.6 / 6.9.5 if you cannot yet move to the 7.0 branch) immediately — this single update addresses both halves of the chain.
2. Do not rely on the staggered CISA deadlines — since CVE-2026-60137 and CVE-2026-63030 are only exploitable as a chain, patch both CVEs in the same maintenance window rather than treating the later August 4 deadline as lower priority.
3. Enable a persistent object cache (e.g., Redis or Memcached) as defense-in-depth if you cannot patch immediately — the vulnerable code path is specifically noted as reachable only when a persistent object cache is not in use.
4. Deploy WAF rules targeting malformed REST API batch requests (/wp-json/batch/v1) if using Cloudflare or another WAF provider that has published rules for this chain.
5. Review web server and WordPress logs for anomalous requests to /wp-json/batch/v1 with malformed sub-request paths, and for unexpected admin users, modified core files, or webshells if the site was internet-facing and unpatched between July 17–20, 2026.