Full Report
A vulnerability chain has been discovered in WordPress Core that could allow for remote code execution. WordPress is an open-source content management system (CMS) used to design, build, and publish personal and commercial websites. Successful exploitation of vulnerability chain could allow for remote code execution in the context of the affected service account. Depending on the privileges associated with the service account, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Services whose accounts are configured to have less rights on the system could be less impacted than those who operate with administrative user rights.
Analysis Summary
Regarding the security advisory provided, here is the clear, actionable summary of the WordPress Core vulnerability chain.
# Vulnerability: WordPress Core Pre-Authentication RCE via WP_Query and REST API
## CVE Details
* **CVE ID:** CVE-2026-60137, CVE-2026-63030
* **CVSS Score:** 9.8 (Critical)
* **CWE:** CWE-89 (SQL Injection), CWE-436 (Route Confusion)
## Affected Systems
* **Products:** WordPress Core
* **Versions:**
* 7.x versions prior to 7.0.2
* 6.9 versions prior to 6.9.5
* 6.8 versions prior to 6.8.6
* **Configurations:** Systems using themes or plugins that pass untrusted input to specific `WP_Query` parameters.
## Vulnerability Description
This is a vulnerability chain consisting of two primary flaws:
1. **CVE-2026-60137:** A SQL Injection vulnerability where WordPress does not properly sanitize the `author__not_in` parameter within the `WP_Query` class.
2. **CVE-2026-63030:** A REST API batch endpoint route confusion issue.
When combined, these flaws allow an unauthenticated attacker to bypass standard security boundaries and execute arbitrary SQL commands. This chain ultimately leads to Remote Code Execution (RCE) by manipulating the database or execution environment through the unsanitized input.
## Exploitation
* **Status:** Exploited in the wild (Telemetry indicates automated scanning); Public Proof-of-Concept (PoC) available.
* **Complexity:** Medium
* **Attack Vector:** Network (Remote)
## Impact
* **Confidentiality:** High (Potential to view all data/database content)
* **Integrity:** High (Ability to modify or delete data and install malicious programs)
* **Availability:** High (Ability to delete data or compromise system stability)
## Remediation
### Patches
Update WordPress Core to the following versions or higher immediately:
* **WordPress 7.0.2**
* **WordPress 6.9.5**
* **WordPress 6.8.6**
### Workarounds
* Ensure the web server/service account is running with the **least privileges** possible to limit the scope of a potential RCE.
* Deploy a Web Application Firewall (WAF) to filter malicious SQL injection patterns in HTTP POST requests.
## Detection
* **Indicators of Compromise:** Review web server logs for suspicious HTTP POST requests targeting the REST API batch endpoints or containing SQL syntax in the `author__not_in` parameter.
* **Detection methods and tools:** Perform automated vulnerability scanning and conduct authenticated/unauthenticated penetration testing (CIS Safeguards 7.7, 16.13).
## References
* [Vendor Advisory: WordPress 7.0.2 Release] hxxps[://]wordpress[.]org/news/2026/07/WordPress-7-0-2-release/
* [NVD - CVE-2026-60137] hxxps[://]nvd[.]nist[.]gov/vuln/detail/cve-2026-60137
* [NVD - CVE-2026-63030] hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-63030
* [MS-ISAC Advisory 2026-070] hxxps[://]www[.]cisecurity[.]org/advisory
* [Research: WP2Shell RCE] hxxps[://]slcyber[.]io/research-center/wp2shell-pre-authentication-rce-in-WordPress-core