🛡️ CVE-2026-60137

The items that name it 6

• gichirimaku/wp2shell-PoC
  repo2026-10-15

  SQL injection in WP_Query triggered by an unsanitized scalar value passed to a REST posts query, yielding a UNION-based blind SQL injection.

• Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms
  writeup2026-09-18It is written here as CVE-2026-60137 (wp2shell exploitation chain).

  wp2shell exploitation chain

• Opening the Black Box: Agentless Threat Detection for Virtual Appliances
  writeup2026-07-22

  Part of 'wp2shell' critical pre-auth RCE vulnerability chain impacting WordPress Core, identified by Wiz Research; attackers deploying persistent webshells

• Agentless Threat Detection: Illuminating Cloud Blind Spots
  article2026-07-21
• wp2shell CVE-2026-63030: The WordPress RCE Putting 500+ Million Sites at Risk
  article2026-07-21It is written here as CVE-2026-60137 (SQL injection in the author__not_in parameter of WP_Query; present since WordPress 6.8).

  SQL injection in the author__not_in parameter of WP_Query; present since WordPress 6.8

• Exploitation in the Wild of wp2shell
  writeup2026-07-20