WordPress Core RCE Chain Actively Exploited
Two chained WordPress Core flaws let unauthenticated attackers achieve SQL injection and remote code execution, with public PoCs and active scanning observed.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-60137 and CVE-2026-63030 as exploited in the wild.
MS-ISAC has issued an advisory on a chained vulnerability in WordPress Core affecting versions prior to 7.0.2, 6.9.5, and 6.8.6. The chain combines an unsanitized author__not_in parameter in WP_Query (CVE-2026-60137), which enables SQL injection, with a REST API batch endpoint route confusion issue (CVE-2026-63030) that together allow an unauthenticated attacker to escalate SQL injection into remote code execution via a crafted HTTP POST request.
The MS-ISAC SOC has observed telemetry indicating automated scanning and exploitation attempts against member organizations, and public proof-of-concept exploits are reportedly circulating. Successful exploitation grants code execution in the context of the web service account, with impact scope dependent on that account's privilege level — ranging from data theft and manipulation to full administrative account creation. Given WordPress's massive install base as a CMS platform, this represents a broad attack surface for opportunistic and automated exploitation.
Organizations running affected WordPress versions should prioritize patching immediately, as the combination of public PoC availability and observed active scanning/exploitation elevates urgency beyond a typical CMS patch advisory.
Mentioned in this report
Detection guidance
WordPress REST API Batch Endpoint SQL Injection Attempt
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP POST requests to the WordPress wp-json batch REST endpoint containing author__not_in combined with SQL injection meta-characters/keywords, matching the CVE-2026-60137/CVE-2026-63030 exploit chain pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WordPress REST API Batch Endpoint SQL Injection Attempt
description: Detects POST requests against the WordPress REST API batch endpoint that
reference the vulnerable author__not_in parameter together with common SQL injection
syntax, consistent with the WP_Query/REST batch route-confusion RCE chain (CVE-2026-60137/CVE-2026-63030).
Generalises on the vulnerable parameter name and injection syntax rather than a
specific payload or attacker IP.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /wp-json
cs-uri-query|contains: batch
param_selection:
cs-uri-query|contains: author__not_in
sqli_selection:
cs-uri-query|contains:
- UNION SELECT
- SLEEP(
- OR 1=1
- ''' --'
- INFORMATION_SCHEMA
condition: selection and param_selection and sqli_selection
falsepositives:
- Authorized vulnerability scanning or penetration testing against the same WordPress
endpoint
- Security research/bug bounty traffic probing the disclosed parameter
level: high
id: c526a2e2-b958-5a1d-b326-51e288509d64
status: experimental
author: Vorant
Web Server Process Spawning Command Shell After Possible RCE
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server or PHP worker process spawning a command shell, a common post-exploitation step after successful RCE via a web application vulnerability such as the WordPress chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Command Shell After Possible RCE
description: Detects Apache/Nginx/PHP-FPM/IIS worker processes spawning a system shell
interpreter, indicating likely successful remote code execution through a web application
vulnerability (e.g. the WordPress WP_Query/REST batch RCE chain). Generalises on
the web-server-to-shell parent/child relationship rather than any specific payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Image|endswith:
- /sh
- /bash
- /dash
filter_package_hooks:
CommandLine|contains:
- logrotate
- apache2ctl
- service apache2
condition: selection and not filter_package_hooks
falsepositives:
- Legitimate CGI scripts or web application features that intentionally invoke shell
commands
- Server management scripts triggered by web-based control panels
level: high
id: 4d64ff3a-4dc9-54e6-a949-f0d37416bfe3
status: experimental
author: Vorant
Web Server Process Executing Reconnaissance or Download Commands
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web server/PHP process directly executing reconnaissance or file-download utilities, consistent with post-RCE staging activity following exploitation of a web application vulnerability like the WordPress chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Executing Reconnaissance or Download Commands
description: Detects Apache/Nginx/PHP-FPM worker processes launching reconnaissance
(whoami, id, uname) or download (wget, curl) utilities, a common pattern immediately
following successful exploitation of a web application RCE such as the WordPress
WP_Query/REST batch chain. Focuses on the parent/child relationship and command
set rather than campaign-specific payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /apache2
- /httpd
- /nginx
- /php-fpm
- /php-fpm7
- /php-fpm8
Image|endswith:
- /whoami
- /id
- /uname
- /wget
- /curl
condition: selection
falsepositives:
- Health-check or monitoring scripts invoked via CGI that call system information
binaries
- Legitimate web application features that shell out to curl/wget for fetching remote
resources
level: medium
id: c48e7a4e-76f8-5002-a98d-486d3fd2ce68
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-chain-in-wordpress-core-could-allow-for-remote-code-execution_2026-070
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs