Search/CVE-2026-60137
● CVE — Medium

CVE-2026-60137

VendorwordpressProductwordpressDiscoveredJul 17, 2026UpdatedOct 7, 2026

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

View graph Watch Export
CVSS v3.1
5.9 MEDIUM
EPSS
5.32%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
34
sources referencing this CVE
Related IOCs
25
seen in the same coverage
EPSS Trend
Aug 26, 2026 → Oct 22, 2026
▼ 73.0pp
78.3% → 5.32% over 3 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityNONE
AvailabilityNONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Connections
43 relationships
Timeline
disclosure → media coverage
Jul 17, 2026
Disclosure — published as a CVE record. · last revised by NVD Oct 7, 2026
Jul 17, 2026
thehackernews.com reports: New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
Jul 18, 2026
acn.gov.it reports: WordPress: PoC pubblico per lo sfruttamento delle CVE-2026-60137 e CVE-2026-63030
Jul 18, 2026
helpnetsecurity.com reports: Two new high severity WordPress vulnerabilities, patch immediately!
Jul 18, 2026
bleepingcomputer.com reports: WordPress Core "wp2shell" RCE flaws get public exploits, patch now
Jul 18, 2026
bsi.bund.de reports: Version 1.0: [WordPress] - [Wordpress]: [Schwachstellen erlauben Remote Code Execution- PoC verfügbar]
Jul 20, 2026
securityweek.com reports: WP2Shell WordPress Vulnerabilities Exploited in the Wild
Jul 20, 2026
securityweek.com reports: Chrome 150 Update Patches Severe Memory Safety Bugs
Jul 20, 2026
research.checkpoint.com reports: 20th July – Threat Intelligence Report
Jul 20, 2026
thehackernews.com reports: ⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
Jul 20, 2026
infosecurity-magazine.com reports: Researchers Build WordPress Exploit Using OpenAI's GPT
Jul 20, 2026
securityweek.com reports: SonicWall Zero-Days Exploited to Deliver Custom Malware for Weeks Before Patch
Jul 20, 2026
isc.sans.edu reports: WordPress Exploitation Underway (CVE-2026-63030), (Mon, Jul 20th)
Jul 20, 2026
darkreading.com reports: 'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
Jul 21, 2026
redhotcyber.com reports: L’RCE Wp2shell nel core WordPress, è stata rilevata da GPT-5.6 con 25 dollari in token
Jul 21, 2026
securityweek.com reports: Zimbra Update Patches Critical Vulnerabilities
Jul 21, 2026
securityweek.com reports: Exploitation of ServiceNow Vulnerability Seen Days After Disclosure
Jul 21, 2026
thehackernews.com reports: WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Jul 21, 2026
malwarebytes.com reports: What happens if you visit a WordPress site hacked through wp2shell?
Jul 21, 2026
bleepingcomputer.com reports: Critical wp2shell WordPress flaws exploited to install webshells
Jul 22, 2026
securityweek.com reports: Fourth SharePoint Vulnerability Exploited in Past Month’s Wave of Attacks
Jul 22, 2026
thehackernews.com reports: Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
Jul 22, 2026
cybersecurity360.it reports: Wp2shell, le vulnerabilità in WordPress: le patch sono urgenti, ma non bastano
Jul 27, 2026
itmedia.co.jp reports: WordPressの脆弱性「wp2shell」　古いバージョンでも自動更新していても安心できない理由
Jul 28, 2026
incibe.es reports: Cadena de vulnerabilidades críticas en WordPress, wp2shell
Aug 3, 2026
itmedia.co.jp reports: 25ドルで見つかったWordPressの脆弱性　生成AIが変えた攻防の時間軸
Aug 25, 2026
securityweek.com reports: WordPress Websites Targeted via MiniOrange Plugin Vulnerabilities
Sep 18, 2026
thehackernews.com reports: New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Sep 22, 2026
thehackernews.com reports: WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Sep 22, 2026
helpnetsecurity.com reports: Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
Sep 22, 2026
bleepingcomputer.com reports: Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
Oct 7, 2026
thehackernews.com reports: Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Oct 21, 2026
bleepingcomputer.com reports: Stolen UpdraftCentral keys used to backdoor WordPress sites
Oct 23, 2026
thehackernews.com reports: Exposed Infrastructure Reveals How Ransomware Affiliates Used AI Agents to Execute Intrusions
Oct 28, 2026
redhotcyber.com reports: PHP2Shell: 67 indicatori, 35 esecuzioni di shell e il confine tra attacco e compromissione. L’analisi tecnica
Public PoC (10)
github.com/h4cd0c/wp2shellgithub.com/codeb0ssx/Ultimate-wp2shellgithub.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpressgithub.com/Colere-Sys/wp2shell-pocgithub.com/northsia/CVE-2026-60137-With-Skip-SSLgithub.com/Dungsocool/CVE-2026-60137_CVE-2026-63030github.com/michael-kanda/Wp2shell-ioc-scannergithub.com/AdarshThakur14777-cyber/CVE-2026-60137github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoCgithub.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030
Unverified third-party code — review before executing.