# CVE-2026-60137: WordPress WP2Shell - SQLi

> Live exploitation tracking for CVE-2026-60137 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-60137

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 5.9
- **Public exploit available:** Yes
- **Affected products:** WordPress
- **Weaknesses:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'))
- **Tags:** wordpress, cms

## Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

## CrowdSec analysis

[CVE-2026-60137](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-60137) is a SQL injection vulnerability in WordPress core: the author__not_in parameter of WP_Query is not sanitised, so a plugin or theme passing untrusted input to it exposes the database. Chained with the REST API batch route confusion CVE-2026-63030, the "wp2shell" chain, it lets unauthenticated attackers run SQL injection and reach remote code execution.

CrowdSec has been tracking this vulnerability and its exploits since 20th of July 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-60137 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
CrowdSec network telemetry also shows that exploitation of CVE-2026-60137 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Attackers reach the flaw through the wp2shell chain: nested requests to the REST batch endpoint `/?rest_route=/batch/v1` aimed at `/wp/v2/categories`, with conditional `SLEEP()` payloads in the `author_exclude` parameter used as a timing oracle to extract database contents.

## Timeline

- 2026-07-17: CVE Published. CVE-2026-60137 is published to NVD.
- 2026-07-20: Rule Released. CrowdSec releases a rule to detect CVE-2026-60137 exploitation attempts against the CrowdSec Network.
- 2026-07-20: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-60137 for the first time.
- 2026-07-21: CISA KEV. CVE-2026-60137 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-08-04: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-60137) follows observed exploitation activity for CVE-2026-60137. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.