CVE-2026-60137: Actively Exploited SQL Injection in WordPress Core (KEV)

Overview

CVE-2026-60137 is a SQL injection vulnerability (CWE-89) in WordPress Core affecting request handling for both unauthenticated and authenticated users. Improper sanitization of input allows attackers to inject malicious SQL syntax into backend database queries, potentially enabling unauthorized data access, data exfiltration, and further compromise of the affected site.

Affected Software

This vulnerability affects WordPress Core. WordPress 7.0.2 remediates the issue; sites running versions prior to this release should be considered vulnerable and prioritized for patching.

Exploitation Status

CVE-2026-60137 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and is being actively exploited in the wild. Per CISA BOD 26-04 prioritization guidance, unpatched sites face critical risk. This is not a theoretical or PoC-only issue — defenders should treat internet-facing WordPress instances as immediate remediation targets and assume adversaries already have working exploit tooling.

Detection Coverage

Exploitation of CVE-2026-60137 typically surfaces as anomalous SQL syntax in HTTP request parameters targeting common WordPress attack surfaces — wp-admin, the wp-json REST API, xmlrpc.php, and plugin/theme AJAX handlers — often followed by unusual database error responses, signs of data exfiltration, or subsequent webshell/backdoor deployment.

Our detection logic identifies this pattern chain by correlating suspicious SQL injection payload indicators in web server and application logs against these endpoints, flagging abnormal database error responses, and surfacing follow-on indicators of compromise such as file writes consistent with webshell deployment. Coverage is shipped across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL), allowing teams to deploy consistent detection regardless of their SIEM/XDR stack.

Recommendations

Patch to WordPress 7.0.2 or later immediately given active KEV exploitation. Until patched, monitor for the indicators above and consider WAF rules targeting SQLi payloads on the affected endpoints.

Full detection logic, query samples, and coverage details are available on the CVE-2026-60137 detection page.