WordPress Core SQL Injection Exploitation (CVE-2026-60137)

let SuspiciousPatterns = dynamic(["UNION SELECT","UNION ALL SELECT","' OR '1'='1","information_schema","SLEEP(","benchmark(","0x2727","CONCAT(0x","--+-","xp_cmdshell"]);
W3CIISLog
| where csUriStem has_any ("/wp-admin", "/wp-json", "/xmlrpc.php", "/wp-content/plugins", "/wp-content/themes")
| where csUriQuery has_any (SuspiciousPatterns) or csUriStem has_any (SuspiciousPatterns)
| extend DecodedQuery = url_decode(csUriQuery)
| where DecodedQuery has_any (SuspiciousPatterns)
| summarize RequestCount = count(), Methods = make_set(csMethod), SampleURIs = make_set(csUriQuery, 5) by cIP, csUriStem, sSiteName, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| order by RequestCount desc

index=web sourcetype=access_combined OR sourcetype=wordpress:access
(uri_path="*/wp-admin*" OR uri_path="*/wp-json*" OR uri_path="*/xmlrpc.php*" OR uri_path="*/wp-content/plugins*")
| eval decoded_query=urldecode(uri_query)
| regex decoded_query="(?i)(union(\s|%20)+select|or(\s|%20)+1(\s|%20)*=(\s|%20)*1|information_schema|sleep\(|benchmark\(|0x2727|concat\(0x|xp_cmdshell)"
| stats count as request_count, values(uri_query) as sample_queries, values(http_method) as methods by clientip, uri_path, host
| where request_count >= 3
| sort - request_count

sequence by source.ip with maxspan=5m
  [network where url.path : ("*/wp-admin*", "*/wp-json*", "*/xmlrpc.php*", "*/wp-content/plugins*") and
   (url.query : "*UNION*SELECT*" or url.query : "*1=1*" or url.query : "*information_schema*" or url.query : "*SLEEP(*" or url.query : "*benchmark(*")]
  [network where url.path : ("*/wp-admin*", "*/wp-json*", "*/xmlrpc.php*") and http.response.status_code >= 500]

SELECT sourceip, "URL", "HTTP Response Code", COUNT(*) AS request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%'
AND ("URL" ILIKE '%/wp-admin%' OR "URL" ILIKE '%/wp-json%' OR "URL" ILIKE '%/xmlrpc.php%')
AND ("URL" ILIKE '%UNION%SELECT%' OR "URL" ILIKE '%1=1%' OR "URL" ILIKE '%information_schema%' OR "URL" ILIKE '%SLEEP(%' OR "URL" ILIKE '%0x2727%')
GROUP BY sourceip, "URL", "HTTP Response Code"
HAVING COUNT(*) >= 3
LAST 24 HOURS

_sourceCategory=Web/Access
| where uri_path matches "*/wp-admin*" or uri_path matches "*/wp-json*" or uri_path matches "*/xmlrpc.php*" or uri_path matches "*/wp-content/plugins*"
| where uri_query matches "*UNION*SELECT*" or uri_query matches "*1=1*" or uri_query matches "*information_schema*" or uri_query matches "*SLEEP(*" or uri_query matches "*benchmark(*"
| count by client_ip, uri_path, host
| where _count >= 3
| sort by _count

rule wordpress_core_sqli_cve_2026_60137 {
  meta:
    description = "Detects SQLi patterns targeting WordPress core endpoints (CVE-2026-60137)"
    severity = "CRITICAL"
    cve = "CVE-2026-60137"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.target.url = /(\/wp-admin|\/wp-json|\/xmlrpc\.php|\/wp-content\/plugins)/ nocase
    $e.network.http.method != ""
    $e.target.url = /(UNION(\s|%20)+SELECT|1(\s|%20)*=(\s|%20)*1|information_schema|SLEEP\(|benchmark\(|0x2727)/ nocase
  match:
    $e.principal.ip over 5m
  condition:
    $e
}

#event_simple_name=HttpRequestEvent
| RequestURI=/*wp-admin*/ OR RequestURI=/*wp-json*/ OR RequestURI=/*xmlrpc.php*/ OR RequestURI=/*wp-content\/plugins*/
| RequestURI=/*UNION*SELECT*/i OR RequestURI=/*1=1*/i OR RequestURI=/*information_schema*/i OR RequestURI=/*SLEEP\(*/i OR RequestURI=/*benchmark\(*/i
| stats count by ClientIP, RequestURI, aid
| filter(count>=3)
| sort(count, order=desc)