Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-60137.
Upgrade to ProDetect WordPress Core SQL Injection Exploitation (CVE-2026-60137) in Microsoft Sentinel
Detects exploitation attempts and successful exploitation of CVE-2026-60137, a SQL injection vulnerability (CWE-89) in WordPress Core affecting unauthenticated or authenticated request handling. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild. Exploitation typically manifests as anomalous SQL syntax in HTTP request parameters targeting WordPress endpoints (wp-admin, wp-json REST API, xmlrpc.php, plugin/theme AJAX handlers), followed by unusual database error responses, data exfiltration patterns, or subsequent webshell/backdoor deployment. WordPress 7.0.2 remediates this issue; unpatched sites remain at critical risk per CISA BOD 26-04 prioritization guidance.
MITRE ATT&CK
KQL Detection Query
let SuspiciousPatterns = dynamic(["UNION SELECT","UNION ALL SELECT","' OR '1'='1","information_schema","SLEEP(","benchmark(","0x2727","CONCAT(0x","--+-","xp_cmdshell"]);
W3CIISLog
| where csUriStem has_any ("/wp-admin", "/wp-json", "/xmlrpc.php", "/wp-content/plugins", "/wp-content/themes")
| where csUriQuery has_any (SuspiciousPatterns) or csUriStem has_any (SuspiciousPatterns)
| extend DecodedQuery = url_decode(csUriQuery)
| where DecodedQuery has_any (SuspiciousPatterns)
| summarize RequestCount = count(), Methods = make_set(csMethod), SampleURIs = make_set(csUriQuery, 5) by cIP, csUriStem, sSiteName, bin(TimeGenerated, 5m)
| where RequestCount >= 3
| order by RequestCount descDetects SQL injection payload patterns in HTTP requests to WordPress core endpoints, consistent with CVE-2026-60137 exploitation attempts against unpatched sites (pre-7.0.2).
Data Sources
Required Tables
False Positives & Tuning
- Security scanners and authorized penetration testing tools generating SQLi test payloads
- Legitimate content containing SQL-like keywords in blog posts or comments being URL-encoded
- Overly broad WAF logging capturing benign query strings with coincidental keyword matches
Other platforms for CVE-2026-60137
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SQLi Probe Against wp-json Endpoint
Expected signal: Web server access log entry with URI query containing 'UNION SELECT' and 'wp_users' targeting /wp-json/wp/v2/posts.
- Test 2Simulate SQLi Probe Against xmlrpc.php
Expected signal: Web access log entry showing xmlrpc.php request with "' OR '1'='1" in the query string.
- Test 3Simulate Time-Based Blind SQLi Probe
Expected signal: Web access log entry for admin-ajax.php containing 'SLEEP(5)' with an observable elevated response time in the log or APM data.
- Test 4Simulate Successful SQLi Followed by Server Error
Expected signal: Two sequential access log entries from the same source IP within a 5-minute window: one containing 'information_schema' and one resulting in an HTTP 500 response.
References (4)
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-60137
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-60137 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month