CVE-2026-60137

MediumPublished

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

Published: Jul 17, 2026
Updated: Oct 7, 2026
Assigning CNA: WPScan
Evidence observed: Jul 21, 2026

Primary CVSS

5.9/ 10Medium

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability estimate

5.3%

Low · next 30 days

Percentile: 92.5%
Model date: Oct 15, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

CISA Known Exploited

This CVE appears in the CISA Known Exploited Vulnerabilities catalog.

Summary

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Sources

Repository evidence: Files: 3 · Repositories: 2

2 Module1 Lab

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route ConfusionModule
modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb
Metasploit Framework modules
DetectionEvidence observed: Sep 25, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- verification: check_declared($.auxiliary_scanner/http/wordpress_wp2shell_sqli.check)
WordPress Pre-Auth RCE via REST API Batch Route Confusion and SQL Injection (wp2shell)Lab
wordpress/CVE-2026-63030
WordPress Pre-Auth RCE via REST API Batch Route Confusion and SQL Injection (wp2shell, CVE-2026-63030 / CVE-2026-60137)
Vulhub vulnerability labs
ResearchEvidence observed: Sep 25, 2026Revision: 9b90d4276f84Related tool
Declared conditions
- lab image version: vulhub/wordpress:6.9.4(wordpress/CVE-2026-63030/docker-compose.yml:services.web.image)
- lab image version: mysql:8.0(wordpress/CVE-2026-63030/docker-compose.yml:services.db.image)
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCEModule
modules/exploits/multi/http/wp_batch_desync_rce.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- platform: Linux,PHP,Unix($.exploit_multi/http/wp_batch_desync_rce.platform)
- verification: check_declared($.exploit_multi/http/wp_batch_desync_rce.check)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.

Sources

Repository evidence: Files: 3 · Repositories: 2

2 Module1 Lab

WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route ConfusionModule
modules/auxiliary/scanner/http/wordpress_wp2shell_sqli.rb
Metasploit Framework modules
DetectionEvidence observed: Sep 25, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- verification: check_declared($.auxiliary_scanner/http/wordpress_wp2shell_sqli.check)
WordPress Pre-Auth RCE via REST API Batch Route Confusion and SQL Injection (wp2shell)Lab
wordpress/CVE-2026-63030
WordPress Pre-Auth RCE via REST API Batch Route Confusion and SQL Injection (wp2shell, CVE-2026-63030 / CVE-2026-60137)
Vulhub vulnerability labs
ResearchEvidence observed: Sep 25, 2026Revision: 9b90d4276f84Related tool
Declared conditions
- lab image version: vulhub/wordpress:6.9.4(wordpress/CVE-2026-63030/docker-compose.yml:services.web.image)
- lab image version: mysql:8.0(wordpress/CVE-2026-63030/docker-compose.yml:services.db.image)
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCEModule
modules/exploits/multi/http/wp_batch_desync_rce.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: b22ce1fbae63Related tool
Declared conditions
- platform: Linux,PHP,Unix($.exploit_multi/http/wp_batch_desync_rce.platform)
- verification: check_declared($.exploit_multi/http/wp_batch_desync_rce.check)