Introduction

The WordPress ecosystem is currently facing one of its most significant security threats in years. Dubbed “wp2shell,” a newly discovered exploit chain targeting WordPress Core allows for unauthenticated remote code execution (RCE) on default installations. At the center of this storm is CVE-2026-60137, a critical SQL injection vulnerability. On July 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added this flaw to its Known Exploited Vulnerabilities (KEV) catalog, signaling that threat actors are actively leveraging it to compromise websites worldwide.

What is CVE-2026-60137?

CVE-2026-60137 is a high-severity SQL injection vulnerability residing within the WordPress WP_Query class. Specifically, the flaw exists in the handling of the author__not_in parameter. Under normal circumstances, WordPress sanitizes inputs to this parameter; however, security researchers discovered that untrusted data can bypass these checks when specific API endpoints are manipulated. This allows an attacker to inject malicious SQL commands directly into the site’s database queries.

Systems and Versions Affected

The vulnerability is particularly dangerous because it exists in the WordPress Core, affecting default installations regardless of which plugins or themes are installed. Specifically, the following versions are vulnerable:

• WordPress 6.8.x: Versions 6.8.0 through 6.8.5
• WordPress 6.9.x: Versions 6.9.0 through 6.9.4
• WordPress 7.0.x: Versions 7.0.0 through 7.0.1

While the SQL injection itself is present in the 6.8.x branch, the full RCE chain (wp2shell) primarily targets the 6.9.x and 7.0.x branches due to their implementation of the REST API batch processing features.

The “wp2shell” Exploit Chain

The true power of CVE-2026-60137 is revealed when it is chained with another vulnerability, CVE-2026-63030 (a REST API batch-route confusion flaw). This combination allows an unauthenticated attacker to achieve what researchers call “Route Confusion.”

1. The attacker sends a crafted request to the /wp-json/batch/v1 endpoint.
2. Exploiting CVE-2026-63030, the attacker desynchronizes the batch processor, forcing WordPress to execute a high-privilege handler using data from a low-privilege request.
3. This “confusion” allows the attacker to pass unsanitized values into the author__not_in parameter, triggering the CVE-2026-60137 SQL injection.
4. The SQL injection is then used to poison the object cache and modify database values.

In a successful wp2shell attack, the final payload creates a new administrative user account or installs a malicious plugin, granting the attacker full remote code execution and administrative control over the entire server.

Impact and Real-World Exploitation

The severity of this flaw cannot be overstated. Because WordPress powers a vast portion of the internet—including government, healthcare, and enterprise sites—an unauthenticated RCE represents a systemic risk. Security firms have already observed automated botnets scanning for vulnerable sites to deploy backdoors and ransomware. The inclusion of CVE-2026-60137 in the CISA KEV catalog mandates that federal agencies patch their systems immediately, but the recommendation extends to all private sector organizations and individual site owners.

Mitigation Steps and Remediation

Immediate action is required to secure vulnerable WordPress installations. Site administrators should follow these steps:

• Update WordPress Core: Upgrade to the latest security releases immediately. The fixed versions are 6.8.6, 6.9.5, and 7.0.2. Many hosting providers have initiated automatic updates, but manual verification is strongly encouraged.
• Implement a Web Application Firewall (WAF): If immediate patching is not possible, configure your WAF to block access to the REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1). Note that this may affect some administrative dashboards or plugin functionality.
• Monitor for Rogue Users: Audit your WordPress user list for newly created administrator accounts that you did not authorize.
• Review Server Logs: Look for unusual POST requests to the /wp-json/batch/v1 endpoint, especially those originating from unknown IP addresses.

The wp2shell vulnerability serves as a stark reminder of the risks associated with core-level flaws in widely used software. By prioritizing these updates, administrators can defend their web presence against one of the most potent threats of 2026.