Response playbooks, investigation guides, and Atomic Red Team tests are Pro-only. Upgrade to unlock the full detection package for CVE-2026-60137.
Upgrade to ProDetect WordPress Core SQL Injection Exploitation (CVE-2026-60137) in Splunk
Detects exploitation attempts and successful exploitation of CVE-2026-60137, a SQL injection vulnerability (CWE-89) in WordPress Core affecting unauthenticated or authenticated request handling. This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is actively being exploited in the wild. Exploitation typically manifests as anomalous SQL syntax in HTTP request parameters targeting WordPress endpoints (wp-admin, wp-json REST API, xmlrpc.php, plugin/theme AJAX handlers), followed by unusual database error responses, data exfiltration patterns, or subsequent webshell/backdoor deployment. WordPress 7.0.2 remediates this issue; unpatched sites remain at critical risk per CISA BOD 26-04 prioritization guidance.
MITRE ATT&CK
SPL Detection Query
index=web sourcetype=access_combined OR sourcetype=wordpress:access
(uri_path="*/wp-admin*" OR uri_path="*/wp-json*" OR uri_path="*/xmlrpc.php*" OR uri_path="*/wp-content/plugins*")
| eval decoded_query=urldecode(uri_query)
| regex decoded_query="(?i)(union(\s|%20)+select|or(\s|%20)+1(\s|%20)*=(\s|%20)*1|information_schema|sleep\(|benchmark\(|0x2727|concat\(0x|xp_cmdshell)"
| stats count as request_count, values(uri_query) as sample_queries, values(http_method) as methods by clientip, uri_path, host
| where request_count >= 3
| sort - request_countIdentifies SQL injection attempts against WordPress core endpoints leveraging CVE-2026-60137, based on decoded query string patterns matching known SQLi syntax.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Automated vulnerability scanners run by internal security teams
- CDN or WAF re-logging of blocked requests still appearing in access logs
- Search engine crawlers submitting malformed query strings
Other platforms for CVE-2026-60137
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate SQLi Probe Against wp-json Endpoint
Expected signal: Web server access log entry with URI query containing 'UNION SELECT' and 'wp_users' targeting /wp-json/wp/v2/posts.
- Test 2Simulate SQLi Probe Against xmlrpc.php
Expected signal: Web access log entry showing xmlrpc.php request with "' OR '1'='1" in the query string.
- Test 3Simulate Time-Based Blind SQLi Probe
Expected signal: Web access log entry for admin-ajax.php containing 'SLEEP(5)' with an observable elevated response time in the log or APM data.
- Test 4Simulate Successful SQLi Followed by Server Error
Expected signal: Two sequential access log entries from the same source IP within a 5-minute window: one containing 'information_schema' and one resulting in an HTTP 500 response.
References (4)
- https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-60137
Unlock playbooks & atomic tests with Pro
Get the full detection package for CVE-2026-60137 — response playbook and atomic red team tests, plus investigation guidance and hunting queries.
df00tech Pro — £29/user/month