CVE-2026-60137: WordPress Core — SQL Injection Leading to RCE Chain

Executive Summary

CVE-2026-60137 is a SQL injection vulnerability in WordPress Core that becomes exploitable in the context of default WordPress 7.x installations when paired with CVE-2026-63030, an interpretation conflict flaw that bypasses sanitisation controls. Together, the two vulnerabilities allow an unauthenticated attacker to achieve remote code execution without requiring any installed plugins or themes beyond a default configuration. CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalog on July 21, 2026. The fix is WordPress 7.0.2.

The SQL injection at the root of this CVE has the characteristics needed for full exploitation: it occurs in a code path reachable without authentication, it targets a database user with sufficient privileges in default WordPress installations to write files to disk, and the chained interpretation conflict removes the usual sanitisation barrier. RCE via web shell deployment is the confirmed exploitation outcome.

Affected Versions

WordPress Core versions prior to 7.0.2 in the 7.x branch. The vulnerability exists in Core’s database abstraction layer when certain input parameters are passed without adequate sanitisation — a condition made reachable without plugin involvement when CVE-2026-63030 is used to bypass the sanitisation step.

Earlier WordPress versions (6.x series) use different code paths and have not been confirmed as affected by the same SQL injection in the same exploitable form.

Vulnerability Details

CWE-89 SQL Injection occurs when user-supplied input is incorporated into a database query without adequate sanitisation or parameterisation, allowing the attacker to alter the query’s structure.

The CISA advisory notes that CVE-2026-60137 is triggered “when a plugin or theme passes untrusted input to the parameter.” In standard isolated analysis, the vulnerability requires a plugin or theme to create the condition. The significance of the chain with CVE-2026-63030 is that the interpretation conflict bypasses the sanitisation that would normally prevent this condition from being reachable in a default installation — effectively allowing the attacker to create the triggering condition without needing a vulnerable plugin.

The SQL injection itself appears in WordPress Core’s $wpdb database abstraction layer, in a query construction pathway that does not consistently use prepared statements for all parameter types. The specific parameter affected accepts query modifiers — ordering, filtering, or range parameters — that are incorporated into the SQL query without complete parameterisation. An attacker who can reach this parameter with a payload that survives the sanitisation step (which CVE-2026-63030 enables) can inject arbitrary SQL.

Exploitation pathway to RCE: On a default MySQL configuration with the WordPress database user having FILE privileges (common in shared hosting and default LAMP/LEMP stack installations), SQL injection can be escalated to code execution via MySQL’s INTO OUTFILE or INTO DUMPFILE directives. These allow writing attacker-controlled content to a file path accessible by the web server, including the WordPress wp-content/uploads directory. Writing a PHP file to a web-accessible path creates a web shell that the attacker can then invoke directly.

The unauthenticated entry point, the default MySQL FILE privilege in many WordPress hosting configurations, and the web-accessible uploads directory combine to make this a reliable RCE chain against a significant proportion of vulnerable installations.

Exploitation in the Wild

CISA’s KEV addition on July 21, 2026 confirms that exploitation has been observed. The federal remediation deadline of August 4 reflects CISA’s standard 14-day window for vulnerabilities with confirmed exploitation but not necessarily ongoing mass exploitation at the time of cataloguing.

The combination of unauthenticated access and RCE capability against 43% of the web’s installed base means this vulnerability will attract broad opportunistic exploitation, likely from multiple threat actors operating botnet infrastructure, cryptomining campaigns, and web shell deployment operations. Historical analogues (WP vulnerabilities enabling unauthenticated access, such as REST API vulnerabilities in WordPress 4.x series) attracted millions of exploitation attempts within days of disclosure.

No specific threat actor attribution or campaign details have been published at time of writing.

Patch and Remediation

Update to WordPress 7.0.2 immediately. Both CVE-2026-60137 and CVE-2026-63030 are addressed in this release. Only patching one leaves the chain exploitable if the other pathway can be triggered through an alternative route.

Steps for remediation:

1. Update WordPress Core to 7.0.2 via your hosting control panel, WP-CLI (wp core update), or the WordPress admin dashboard. Auto-updates should have already applied this for most managed hosting environments.

2. Verify the update applied by checking wp-includes/version.php or the WordPress admin footer for version 7.0.2.

3. Audit MySQL database user privileges: Remove FILE privilege from the WordPress database user if present. This eliminates the INTO OUTFILE escalation path even if a future SQL injection vulnerability were discovered. Execute: REVOKE FILE ON *.* FROM 'wordpress_user'@'localhost';

4. Scan for web shells: Run WPScan, Wordfence, or a manual file integrity check against wp-content/uploads, wp-content/themes, and wp-content/plugins for unexpected PHP files.

5. Review database logs: If general query logging was enabled, check for anomalous SELECT ... INTO OUTFILE queries from the WordPress database user.

If immediate patching is not possible: Deploy WAF rules targeting SQL injection payloads in the affected parameter positions. Apply rate limiting to unauthenticated requests to WordPress AJAX and REST API endpoints. Monitor for file system changes in the WordPress document root.

Detection

Web shell indicators: New .php files in wp-content/uploads (uploads should not contain executable PHP), modified timestamps on files in core directories, files with obfuscated or base64-encoded content.

Log patterns: HTTP POST requests to WordPress AJAX endpoints (admin-ajax.php) or REST API routes with URL-encoded SQL metacharacters in body parameters. Response codes 200 or 500 to requests containing UNION SELECT, INTO OUTFILE, INFORMATION_SCHEMA, or hex-encoded variants.

Database indicators: MySQL general query log entries showing SELECT ... INTO OUTFILE or INTO DUMPFILE from the WordPress application user. Error log entries showing MySQL syntax errors that weren’t generated by normal WordPress queries.

Post-exploitation patterns: New web processes spawned from the web server user account, outbound network connections from the web server, scheduled tasks created by the web server user, or unusual curl/wget executions visible in process logs.

SIEM queries: Alert on web server log entries containing wp-content/uploads/*.php in the request URI — this catches both web shell deployment (POST to write the shell) and subsequent web shell execution (any request to a .php file in uploads).

References

• WordPress 7.0.2 Release Notes
• NVD — CVE-2026-60137
• CISA KEV Catalog
• CVE-2026-63030 (interpretation conflict chain component — see separate Vuln Brief analysis)