THREAT OPS › CVEs › CVE-2026-60137
CVE-2026-60137 — WordPress Core SQL Injection Vulnerability
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Vulnerability details
- Affected productsCore
- KEV remediation due2026-08-04
Related reporting
- Metasploit Wrap Up: Lot of summer shells and fit http profilesrapid7
- July 2026 CVE Landscaperecordedfuture
- wp2shell Aftermath: The First Critical Unauthenticated WordPress Core RCE in Nearly a Decadewordfence
- CVE-2026-63030 and CVE-2026-60137: Mitigating a Critical Unauthenticated RCE Chain in WordPressakamai_blog
- WordPress security advisory (AV26-723) - Update 1cccs_ca
- Exploitation in the Wild of wp2shellwiz_research
- Wordfence Intelligence Weekly WordPress Vulnerability Report (July 13, 2026 to July 19, 2026)wordfence
- wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command executionelastic_security
- Don’t swing at everythingtalos
- wp2shell (CVE-2026-63030, CVE-2026-60137): Frequently asked questions about remote code execution chain in WordPress Coretenable
- WordPress Core Pre-Auth RCE Chain Exploited in the Wildorca_security
- 20th July – Threat Intelligence Reportcheckpoint_research
- CISA Adds Four Known Exploited Vulnerabilities to Catalogcisa_advisories
- [CISA KEV] CVE-2026-60137 — WordPress Core: WordPress Core SQL Injection Vulnerabilitycisa_kev
- [CISA KEV] CVE-2026-63030 — WordPress Core: WordPress Core Interpretation Conflict Vulnerabilitycisa_kev
- WP2Shell WordPress Exploit Technical Analysis and Real Attack Datawordfence
- PSA: WordPress Core Patched Unauthenticated Remote Code Execution Vulnerability Chainwordfence
- CVE-2026-63030: wp2shell a Critical Remote Code Execution Vulnerability in WordPress Corerapid7
- CVE-2026-60137 / CVE-2026-63030 | WordPress Core SQL Injection and Pre-Authentication Remote Code Execution Vulnerabilitieshorizon3
- WordPress Multiple Vulnerabilitieshkcert