Skip to content
SQL Injection and RCE Vulnerabilities in WordPress Exploited

SQL Injection and RCE Vulnerabilities in WordPress Exploited

First seen 14 Oct 2026, 17:34 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 17:35 UTC

Two vulnerabilities, CVE-2026-60137 and CVE-2026-63030, affecting WordPress versions 6.9.0 to 7.0.1, have been confirmed to allow unauthorized SQL injection and remote code execution. These vulnerabilities impact over 500 million WordPress sites, with exploitation confirmed in the wild. The first CVE allows SQL injection via the `author__not_in` parameter, while the second involves a route confusion issue in the REST API. Tools like `wpsqli` and `wordpress-rest-exploit.py` have been developed to exploit these vulnerabilities, allowing attackers to extract sensitive data and potentially deploy web shells. WordPress has released patches in version 6.9.5 and 7.0.2 to address these issues. Security professionals are urged to update their installations immediately to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-07-17
CVE-2026-60137 and CVE-2026-63030 published
Two critical vulnerabilities affecting WordPress were publicly disclosed, impacting millions of sites.
Sploitus
2026-07-21
CVE added to CISA KEV
CISA added both CVEs to its Known Exploited Vulnerabilities catalog due to confirmed exploitation.
Sploitus
2026-10-12
Proof-of-concept tools released
Tools for exploiting the vulnerabilities were released, demonstrating their potential for unauthorized access.
Sploitus
2026-10-13
Patches released
WordPress released updates to fix the vulnerabilities in versions 6.9.5 and 7.0.2.
Sploitus

More articles in this cluster (3)

Following this threat?

Track CVE-2026-60137 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

Which WordPress versions are affected?
WordPress versions 6.9.0 to 7.0.1 are affected by these vulnerabilities.
Is there active exploitation of these vulnerabilities?
Yes, both vulnerabilities have been confirmed to be actively exploited in the wild.
What should I do to protect my site?
Update your WordPress installation to version 6.9.5 or 7.0.2 immediately to mitigate the risks.