CVE-2026-60137: WordPress Core — SQL Injection Leading to RCE Chain

Background

WordPress is the world’s most widely deployed content management system, powering approximately 43% of websites globally across industries, geographies, and organisation sizes. WordPress Core is the base installation that all WordPress sites share; vulnerabilities in Core affect the entire installed base without requiring any additional plugins or themes.

CVE-2026-60137 is a SQL injection vulnerability (CWE-89) in WordPress Core’s database abstraction layer. In isolation, it requires a plugin or theme to create the condition for exploitation. However, when chained with CVE-2026-63030 — an interpretation conflict flaw in the same Core release — an unauthenticated attacker can achieve remote code execution on a default WordPress 7.x installation with no plugins installed. CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalogue on 21 July 2026. The fix is WordPress 7.0.2.

Technical Mechanism

CWE-89 SQL Injection occurs when user-supplied input is incorporated into a database query without adequate sanitisation or parameterisation, allowing the attacker to alter the query’s logical structure.

The SQL injection in CVE-2026-60137 is present in WordPress Core’s $wpdb database abstraction layer. The vulnerable code path accepts query modifier parameters — ordering, filtering, or range values — and incorporates them into SQL queries without complete parameterisation. Under normal circumstances, WordPress’s sanitisation layer would prevent an attacker-controlled payload from reaching the database query construction step.

CVE-2026-63030 removes this barrier. That interpretation conflict flaw causes certain multi-byte character sequences to pass through WordPress’s PHP-level sanitisation while the MySQL client driver subsequently normalises them in ways that reintroduce SQL syntax. The chained attack sequence:

1. Attacker crafts a payload embedding SQL syntax in multi-byte character sequences
2. CVE-2026-63030’s interpretation conflict allows the payload to pass through sanitisation unchecked
3. CVE-2026-60137’s SQL injection delivers the unsanitised payload to the database query
4. On MySQL installations where the WordPress database user has FILE privilege (common in shared hosting and default LAMP/LEMP stacks), the attacker uses INTO OUTFILE or INTO DUMPFILE to write a PHP web shell to the wp-content/uploads directory
5. The web shell is invoked via HTTP, achieving arbitrary code execution as the web server user

This chain is unauthenticated against default WordPress 7.x installations and requires no plugin involvement to trigger.

Real-World Exploitation Evidence

CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalogue on 21 July 2026. The federal remediation deadline of 4 August 2026 reflects CISA’s standard 14-day window for vulnerabilities with confirmed exploitation.

No specific threat actor or campaign has been publicly attributed at time of writing. However, the characteristics of this vulnerability — unauthenticated RCE, no plugins required, affects 43% of the web — closely match the profile that historically attracts mass opportunistic exploitation from multiple simultaneous actor categories. Historical analogues such as WordPress REST API vulnerabilities in the 4.x series attracted millions of exploitation attempts within days of disclosure.

Anticipated exploitation actors include botnet infrastructure operators (web shell deployment for DDoS or spam relaying), cryptominer installers, data exfiltration operators targeting wp-content databases, and initial access brokers selling web shell access to downstream ransomware operators.

Impact Assessment

Successful exploitation achieves unauthenticated remote code execution as the web server user on any unpatched WordPress 7.x installation where the MySQL user has FILE privilege. The impact extends beyond the WordPress application:

Web server compromise: Code execution as the web server user provides access to all files readable by that account, including other sites hosted in the same account (shared hosting environments), WordPress configuration files containing database credentials (wp-config.php), and server-side scripts.

Database credential exposure: wp-config.php contains the WordPress database credentials in plaintext. An attacker with a web shell can read and exfiltrate these credentials for direct database access.

Content manipulation: Full control over WordPress file storage enables defacement, malicious content injection into served pages, and supply chain attacks targeting visitors.

Persistence: Web shells in wp-content/uploads survive WordPress core updates if not detected, providing persistent access independent of the original exploitation path.

Scale: The 43% WordPress market share means the absolute number of vulnerable installations runs into the tens of millions.

Affected Versions

Earlier WordPress versions (6.x series and below) use different code paths and have not been confirmed as affected by the same SQL injection in the same exploitable form.

WordPress.com-hosted sites received automatic patching. Self-hosted installations are the primary at-risk population and require manual update.

Remediation Steps

1. Update WordPress Core to 7.0.2 via your hosting control panel, WP-CLI (wp core update), or the WordPress admin dashboard (Dashboard > Updates). WordPress 7.0.2 patches both CVE-2026-60137 and CVE-2026-63030. Only patching one leaves the chain potentially exploitable if an alternative trigger path exists.

2. Verify the update applied by checking wp-includes/version.php or the WordPress admin footer for version 7.0.2.

3. Revoke the FILE privilege from the WordPress database user. This eliminates the INTO OUTFILE escalation path even if a future SQL injection vulnerability were discovered:

   REVOKE FILE ON *.* FROM 'wordpress_user'@'localhost';

4. Scan for web shells. Run WPScan, Wordfence, or a manual file integrity check against wp-content/uploads, wp-content/themes, and wp-content/plugins for unexpected PHP files.

5. Review database logs if general query logging was enabled. Check for SELECT ... INTO OUTFILE queries from the WordPress database user.

6. If immediate patching is not possible: Deploy WAF rules targeting SQL injection payloads in the affected parameter positions. Apply rate limiting to unauthenticated requests to WordPress AJAX and REST API endpoints.

Detection Guidance

Web shell indicators: New .php files in wp-content/uploads (uploads should not contain executable PHP). Modified timestamps on files in core directories. Files with obfuscated or base64-encoded content in WordPress directories.

HTTP log patterns: POST requests to WordPress AJAX endpoints (admin-ajax.php) or REST API routes with URL-encoded SQL metacharacters in body parameters. Any requests to .php files within wp-content/uploads/ — the path should not serve PHP.

Database indicators: MySQL general query log entries showing SELECT ... INTO OUTFILE or INTO DUMPFILE from the WordPress application user. Error log entries showing MySQL syntax errors not generated by normal WordPress queries.

Post-exploitation process patterns: New processes spawned from the web server user account. Outbound network connections from the web server. Scheduled tasks or cron entries created by the web server user. Unusual curl/wget executions visible in process logs.

SIEM alert: HTTP server log entries with wp-content/uploads/*.php in the request URI — this pattern catches both web shell write (POST) and web shell execution (any request to a PHP file in uploads).

Timeline

References

• WordPress 7.0.2 Release Notes
• NVD — CVE-2026-60137
• CISA KEV Catalog
• NVD — CVE-2026-63030 (interpretation conflict chain component)