Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-60137.
Upgrade to ProDetect WordPress Core SQL Injection Exploitation (CVE-2026-60137) in IBM QRadar
Detects exploitation attempts and successful exploitation of CVE-2026-60137, a SQL injection vulnerability (CWE-89) in WordPress Core affecting unauthenticated or authenticated request handling. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild. Exploitation typically manifests as anomalous SQL syntax in HTTP request parameters targeting WordPress endpoints (wp-admin, wp-json REST API, xmlrpc.php, plugin/theme AJAX handlers), followed by unusual database error responses, data exfiltration patterns, or subsequent webshell/backdoor deployment. WordPress 7.0.2 remediates this issue; unpatched sites remain at critical risk per CISA BOD 26-04 prioritization guidance.
MITRE ATT&CK
QRadar Detection Query
SELECT sourceip, "URL", "HTTP Response Code", COUNT(*) AS request_count
FROM events
WHERE LOGSOURCETYPENAME(devicetype) ILIKE '%web%'
AND ("URL" ILIKE '%/wp-admin%' OR "URL" ILIKE '%/wp-json%' OR "URL" ILIKE '%/xmlrpc.php%')
AND ("URL" ILIKE '%UNION%SELECT%' OR "URL" ILIKE '%1=1%' OR "URL" ILIKE '%information_schema%' OR "URL" ILIKE '%SLEEP(%' OR "URL" ILIKE '%0x2727%')
GROUP BY sourceip, "URL", "HTTP Response Code"
HAVING COUNT(*) >= 3
LAST 24 HOURSFlags repeated HTTP requests containing SQL injection syntax against WordPress endpoints, mapped to CVE-2026-60137 exploitation in the KEV catalog.
Data Sources
Required Tables
False Positives & Tuning
- Internal red team or bug bounty testing generating similar payloads
- Misconfigured monitoring tools replaying captured traffic containing SQL keywords
- Non-malicious REST API clients sending complex filter query strings
Other platforms for CVE-2026-60137
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SQLi Probe Against wp-json Endpoint
Expected signal: Web server access log entry with URI query containing 'UNION SELECT' and 'wp_users' targeting /wp-json/wp/v2/posts.
- Test 2Simulate SQLi Probe Against xmlrpc.php
Expected signal: Web access log entry showing xmlrpc.php request with "' OR '1'='1" in the query string.
- Test 3Simulate Time-Based Blind SQLi Probe
Expected signal: Web access log entry for admin-ajax.php containing 'SLEEP(5)' with an observable elevated response time in the log or APM data.
- Test 4Simulate Successful SQLi Followed by Server Error
Expected signal: Two sequential access log entries from the same source IP within a 5-minute window: one containing 'information_schema' and one resulting in an HTTP 500 response.
References (4)
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-60137
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-60137 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month