VORANT. Threat Intelligence Sign in Get the full feed

WordPress Core RCE Chain Actively Exploited

high vulnerability technologygovernment-national

Two chained WordPress Core flaws let unauthenticated attackers achieve SQL injection and remote code execution, with public PoCs and active scanning observed.

MS-ISAC has issued an advisory on a chained vulnerability in WordPress Core affecting versions prior to 7.0.2, 6.9.5, and 6.8.6. The chain combines an unsanitized author__not_in parameter in WP_Query (CVE-2026-60137), which enables SQL injection, with a REST API batch endpoint route confusion issue (CVE-2026-63030) that together allow an unauthenticated attacker to escalate SQL injection into remote code execution via a crafted HTTP POST request.

The MS-ISAC SOC has observed telemetry indicating automated scanning and exploitation attempts against member organizations, and public proof-of-concept exploits are reportedly circulating. Successful exploitation grants code execution in the context of the web service account, with impact scope dependent on that account's privilege level — ranging from data theft and manipulation to full administrative account creation. Given WordPress's massive install base as a CMS platform, this represents a broad attack surface for opportunistic and automated exploitation.

Organizations running affected WordPress versions should prioritize patching immediately, as the combination of public PoC availability and observed active scanning/exploitation elevates urgency beyond a typical CMS patch advisory.

Mentioned in this report

Vulnerabilities CVE-2026-60137KEVCVE-2026-63030KEV

Detection guidance

WordPress REST API Batch Endpoint SQL Injection Attempt

ATT&CK T1190

Detects HTTP POST requests to the WordPress wp-json batch REST endpoint containing author__not_in combined with SQL injection meta-characters/keywords, matching the CVE-2026-60137/CVE-2026-63030 exploit chain pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: WordPress REST API Batch Endpoint SQL Injection Attempt
description: Detects POST requests against the WordPress REST API batch endpoint that
  reference the vulnerable author__not_in parameter together with common SQL injection
  syntax, consistent with the WP_Query/REST batch route-confusion RCE chain (CVE-2026-60137/CVE-2026-63030).
  Generalises on the vulnerable parameter name and injection syntax rather than a
  specific payload or attacker IP.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: webserver
detection:
  selection:
    cs-method: POST
    cs-uri-stem|contains: /wp-json
    cs-uri-query|contains: batch
  param_selection:
    cs-uri-query|contains: author__not_in
  sqli_selection:
    cs-uri-query|contains:
    - UNION SELECT
    - SLEEP(
    - OR 1=1
    - ''' --'
    - INFORMATION_SCHEMA
  condition: selection and param_selection and sqli_selection
falsepositives:
- Authorized vulnerability scanning or penetration testing against the same WordPress
  endpoint
- Security research/bug bounty traffic probing the disclosed parameter
level: high
id: c526a2e2-b958-5a1d-b326-51e288509d64
status: experimental
author: Vorant

Web Server Process Spawning Command Shell After Possible RCE

ATT&CK T1190

Detects a web server or PHP worker process spawning a command shell, a common post-exploitation step after successful RCE via a web application vulnerability such as the WordPress chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Spawning Command Shell After Possible RCE
description: Detects Apache/Nginx/PHP-FPM/IIS worker processes spawning a system shell
  interpreter, indicating likely successful remote code execution through a web application
  vulnerability (e.g. the WordPress WP_Query/REST batch RCE chain). Generalises on
  the web-server-to-shell parent/child relationship rather than any specific payload.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    Image|endswith:
    - /sh
    - /bash
    - /dash
  filter_package_hooks:
    CommandLine|contains:
    - logrotate
    - apache2ctl
    - service apache2
  condition: selection and not filter_package_hooks
falsepositives:
- Legitimate CGI scripts or web application features that intentionally invoke shell
  commands
- Server management scripts triggered by web-based control panels
level: high
id: 4d64ff3a-4dc9-54e6-a949-f0d37416bfe3
status: experimental
author: Vorant

Web Server Process Executing Reconnaissance or Download Commands

ATT&CK T1190

Detects a web server/PHP process directly executing reconnaissance or file-download utilities, consistent with post-RCE staging activity following exploitation of a web application vulnerability like the WordPress chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Web Server Process Executing Reconnaissance or Download Commands
description: Detects Apache/Nginx/PHP-FPM worker processes launching reconnaissance
  (whoami, id, uname) or download (wget, curl) utilities, a common pattern immediately
  following successful exploitation of a web application RCE such as the WordPress
  WP_Query/REST batch chain. Focuses on the parent/child relationship and command
  set rather than campaign-specific payloads.
tags:
- attack.initial-access
- attack.t1190
- attack.discovery
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith:
    - /apache2
    - /httpd
    - /nginx
    - /php-fpm
    - /php-fpm7
    - /php-fpm8
    Image|endswith:
    - /whoami
    - /id
    - /uname
    - /wget
    - /curl
  condition: selection
falsepositives:
- Health-check or monitoring scripts invoked via CGI that call system information
  binaries
- Legitimate web application features that shell out to curl/wget for fetching remote
  resources
level: medium
id: c48e7a4e-76f8-5002-a98d-486d3fd2ce68
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-chain-in-wordpress-core-could-allow-for-remote-code-execution_2026-070

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free