Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| WordPress | WordPress | 6.8.0 – < 6.8.6, 6.9.0 – < 6.9.5, 7.0.0 – < 7.0.2 | 6.8.6 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 7.0.2+dfsg1-1 | — |
| Debian 13 | wordpress | 6.8.6+dfsg1-0+deb13u1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | wordpress | No fix yet | — |
| Ubuntu 16.04 LTS | wordpress | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 2 modules
-
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
exploit/multi/http/wp_batch_desync_rce
-
WordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
auxiliary/scanner/http/wordpress_wp2shell_sqli
GitHub 10 repositories
-
Colere-Sys/wp2shell-poc ★ 4 · Jul 21, 2026
Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030
-
ivanesk315/CVE-2026-60137-and-CVE-2026-63030 ★ 0 · Sep 10, 2026
-
saretawa/wp2blind ★ 0 · Aug 23, 2026
blind sqli data extraction using CVE-2026-60137 / CVE-2026-63030
-
AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC ★ 0 · Aug 5, 2026
Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` param…
-
AdarshThakur14777-cyber/CVE-2026-60137 ★ 0 · Aug 3, 2026
wpsqli full SQLi extractor + dumper for CVE-2026-60137
-
michael-kanda/Wp2shell-ioc-scanner ★ 0 · Aug 1, 2026
Read-only-by-default WordPress incident-response scanner for the “wp2shell” attack chain (CVE-2026-60137 / CVE-2026-63030): detects shadow-admin, database and filesystem IOCs, verifies core integrity…
-
Dungsocool/CVE-2026-60137_CVE-2026-63030 ★ 0 · Jul 27, 2026
-
northsia/CVE-2026-60137-With-Skip-SSL ★ 0 · Jul 26, 2026
Adding --insecure to skip ssl
-
mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress ★ 0 · Jul 21, 2026
CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)
-
h4cd0c/wp2shell ★ 0 · Jul 18, 2026
wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution o…
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 2
- WID-SEC-2026-2409 WordPress: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Jul 23, 2026
- NCSC-2026-0250 Kwetsbaarheden verholpen in WordPress door Automattic NCSC-NL (Netherlands) · Jul 18, 2026
References
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf vdb-entry technical-description
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ release-notes vendor-advisory