Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-60137.
Upgrade to ProDetect WordPress Core SQL Injection Exploitation (CVE-2026-60137) in Elastic Security
Detects exploitation attempts and successful exploitation of CVE-2026-60137, a SQL injection vulnerability (CWE-89) in WordPress Core affecting unauthenticated or authenticated request handling. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild. Exploitation typically manifests as anomalous SQL syntax in HTTP request parameters targeting WordPress endpoints (wp-admin, wp-json REST API, xmlrpc.php, plugin/theme AJAX handlers), followed by unusual database error responses, data exfiltration patterns, or subsequent webshell/backdoor deployment. WordPress 7.0.2 remediates this issue; unpatched sites remain at critical risk per CISA BOD 26-04 prioritization guidance.
MITRE ATT&CK
Elastic Detection Query
sequence by source.ip with maxspan=5m
[network where url.path : ("*/wp-admin*", "*/wp-json*", "*/xmlrpc.php*", "*/wp-content/plugins*") and
(url.query : "*UNION*SELECT*" or url.query : "*1=1*" or url.query : "*information_schema*" or url.query : "*SLEEP(*" or url.query : "*benchmark(*")]
[network where url.path : ("*/wp-admin*", "*/wp-json*", "*/xmlrpc.php*") and http.response.status_code >= 500]Correlates SQLi-pattern requests to WordPress endpoints followed by server error responses, indicating potential successful exploitation of CVE-2026-60137.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate application errors unrelated to injection attempts occurring within the correlation window
- Load testing tools generating high error rates with coincidental query strings
- Third-party plugin bugs producing 500 errors independent of attacker activity
Other platforms for CVE-2026-60137
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SQLi Probe Against wp-json Endpoint
Expected signal: Web server access log entry with URI query containing 'UNION SELECT' and 'wp_users' targeting /wp-json/wp/v2/posts.
- Test 2Simulate SQLi Probe Against xmlrpc.php
Expected signal: Web access log entry showing xmlrpc.php request with "' OR '1'='1" in the query string.
- Test 3Simulate Time-Based Blind SQLi Probe
Expected signal: Web access log entry for admin-ajax.php containing 'SLEEP(5)' with an observable elevated response time in the log or APM data.
- Test 4Simulate Successful SQLi Followed by Server Error
Expected signal: Two sequential access log entries from the same source IP within a 5-minute window: one containing 'information_schema' and one resulting in an HTTP 500 response.
References (4)
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-60137
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-60137 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month