# WordPress Core RCE Chain Actively Exploited Published: 2026-07-20 · Severity: high · Sectors: technology, government-national Canonical: https://vorant.io/reports/d83958ed-39d0-5d1f-a8dc-a4aefdcd8c03/wordpress-core-rce-chain-actively-exploited > Two chained WordPress Core flaws let unauthenticated attackers achieve SQL injection and remote code execution, with public PoCs and active scanning observed. MS-ISAC has issued an advisory on a chained vulnerability in WordPress Core affecting versions prior to 7.0.2, 6.9.5, and 6.8.6. The chain combines an unsanitized author__not_in parameter in WP_Query (CVE-2026-60137), which enables SQL injection, with a REST API batch endpoint route confusion issue (CVE-2026-63030) that together allow an unauthenticated attacker to escalate SQL injection into remote code execution via a crafted HTTP POST request. The MS-ISAC SOC has observed telemetry indicating automated scanning and exploitation attempts against member organizations, and public proof-of-concept exploits are reportedly circulating. Successful exploitation grants code execution in the context of the web service account, with impact scope dependent on that account's privilege level — ranging from data theft and manipulation to full administrative account creation. Given WordPress's massive install base as a CMS platform, this represents a broad attack surface for opportunistic and automated exploitation. Organizations running affected WordPress versions should prioritize patching immediately, as the combination of public PoC availability and observed active scanning/exploitation elevates urgency beyond a typical CMS patch advisory. ## Mentioned in this report - Vulnerabilities: CVE-2026-60137 (KEV), CVE-2026-63030 (KEV) ## Detection guidance (public sample) ### WordPress REST API Batch Endpoint SQL Injection Attempt ATT&CK: T1190 Detects HTTP POST requests to the WordPress wp-json batch REST endpoint containing author__not_in combined with SQL injection meta-characters/keywords, matching the CVE-2026-60137/CVE-2026-63030 exploit chain pattern. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: WordPress REST API Batch Endpoint SQL Injection Attempt description: Detects POST requests against the WordPress REST API batch endpoint that reference the vulnerable author__not_in parameter together with common SQL injection syntax, consistent with the WP_Query/REST batch route-confusion RCE chain (CVE-2026-60137/CVE-2026-63030). Generalises on the vulnerable parameter name and injection syntax rather than a specific payload or attacker IP. tags: - attack.initial-access - attack.t1190 logsource: category: webserver detection: selection: cs-method: POST cs-uri-stem|contains: /wp-json cs-uri-query|contains: batch param_selection: cs-uri-query|contains: author__not_in sqli_selection: cs-uri-query|contains: - UNION SELECT - SLEEP( - OR 1=1 - ''' --' - INFORMATION_SCHEMA condition: selection and param_selection and sqli_selection falsepositives: - Authorized vulnerability scanning or penetration testing against the same WordPress endpoint - Security research/bug bounty traffic probing the disclosed parameter level: high id: c526a2e2-b958-5a1d-b326-51e288509d64 status: experimental author: Vorant ``` ### Web Server Process Spawning Command Shell After Possible RCE ATT&CK: T1190 Detects a web server or PHP worker process spawning a command shell, a common post-exploitation step after successful RCE via a web application vulnerability such as the WordPress chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Web Server Process Spawning Command Shell After Possible RCE description: Detects Apache/Nginx/PHP-FPM/IIS worker processes spawning a system shell interpreter, indicating likely successful remote code execution through a web application vulnerability (e.g. the WordPress WP_Query/REST batch RCE chain). Generalises on the web-server-to-shell parent/child relationship rather than any specific payload. tags: - attack.initial-access - attack.t1190 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /apache2 - /httpd - /nginx - /php-fpm - /php-fpm7 - /php-fpm8 Image|endswith: - /sh - /bash - /dash filter_package_hooks: CommandLine|contains: - logrotate - apache2ctl - service apache2 condition: selection and not filter_package_hooks falsepositives: - Legitimate CGI scripts or web application features that intentionally invoke shell commands - Server management scripts triggered by web-based control panels level: high id: 4d64ff3a-4dc9-54e6-a949-f0d37416bfe3 status: experimental author: Vorant ``` ### Web Server Process Executing Reconnaissance or Download Commands ATT&CK: T1190 Detects a web server/PHP process directly executing reconnaissance or file-download utilities, consistent with post-RCE staging activity following exploitation of a web application vulnerability like the WordPress chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates. ```yaml title: Web Server Process Executing Reconnaissance or Download Commands description: Detects Apache/Nginx/PHP-FPM worker processes launching reconnaissance (whoami, id, uname) or download (wget, curl) utilities, a common pattern immediately following successful exploitation of a web application RCE such as the WordPress WP_Query/REST batch chain. Focuses on the parent/child relationship and command set rather than campaign-specific payloads. tags: - attack.initial-access - attack.t1190 - attack.discovery logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: - /apache2 - /httpd - /nginx - /php-fpm - /php-fpm7 - /php-fpm8 Image|endswith: - /whoami - /id - /uname - /wget - /curl condition: selection falsepositives: - Health-check or monitoring scripts invoked via CGI that call system information binaries - Legitimate web application features that shell out to curl/wget for fetching remote resources level: medium id: c48e7a4e-76f8-5002-a98d-486d3fd2ce68 status: experimental author: Vorant ``` Behavioural rules are generated from public reporting — validate in your environment before deploying. Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-chain-in-wordpress-core-could-allow-for-remote-code-execution_2026-070 --- This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/d83958ed-39d0-5d1f-a8dc-a4aefdcd8c03/wordpress-core-rce-chain-actively-exploited. Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup