CVE-2026-60137

Exploitation active confirmée

Ajoutée au catalogue CISA KEV le 21/07/2026, correctif exigé avant le 04/08/2026 pour les agences fédérales américaines.

Action requise : Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Description officielle (NVD)

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Preuves de concept publiques (11)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

• codeb0ssx/Ultimate-wp2shell · ★ 10 · 18/07/2026
  wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on
• Colere-Sys/wp2shell-poc · ★ 4 · 21/07/2026
  Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030
• h4cd0c/wp2shell · ★ 0 · 18/07/2026
  wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on
• mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress · ★ 0 · 21/07/2026
  CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)
• northsia/CVE-2026-60137-With-Skip-SSL · ★ 0 · 26/07/2026
  Adding --insecure to skip ssl
• Dungsocool/CVE-2026-60137_CVE-2026-63030 · ★ 0 · 27/07/2026
• michael-kanda/Wp2shell-ioc-scanner · ★ 0 · 01/08/2026
  Read-only-by-default WordPress incident-response scanner for the “wp2shell” attack chain (CVE-2026-60137 / CVE-2026-63030): detects shadow-admin, database and filesystem IOCs, verifies core integrity,
• AdarshThakur14777-cyber/CVE-2026-60137 · ★ 0 · 03/08/2026
  wpsqli full SQLi extractor + dumper for CVE-2026-60137
• AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC · ★ 0 · 05/08/2026
  Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parame
• ivanesk315/CVE-2026-60137-and-CVE-2026-63030 · ★ 0 · 10/09/2026

Les 10 dépôts les plus suivis sont affichés.

Références

• https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf , Vendor Advisory
• https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ , Release Notes
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 , US Government Resource

En bref

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS : probabilité estimée d'exploitation dans les 30 prochains jours.

Produits concernés

Sources officielles

Besoin d'aide ?

Nos experts évaluent votre exposition et vous accompagnent dans la correction.