WordPress Core Critical SQL Injection Vulnerability CVE-2026-60137 Added to CISA KEV Under Active Exploitation

Executive Lead & Global CMS Threat Context

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an emergency operational directive by adding two critical flaws affecting WordPress Core—CVE-2026-60137 (SQL Injection) and CVE-2026-63030 (Interpretation Conflict)—to its Known Exploited Vulnerabilities (KEV) catalog. Classified with maximum CVSS base scores of 9.8 Critical, these vulnerabilities impact the fundamental query construction architecture within the world's most widely utilized Content Management System (CMS), which powers over 43% of the world's top ten million websites.

Active threat telemetry indicates that automated exploit scanners and criminal syndicates have mobilized global scanning infrastructure to target unpatched enterprise WordPress installations, WooCommerce digital storefronts, and government publishing portals. Because WordPress Core serves as the bedrock for user authentication, content publication, and transactional database storage, an unmitigated SQL injection vulnerability allows unauthenticated remote adversaries to bypass administrative access controls, exfiltrate sensitive customer records and cryptographic salts, create stealth administrative users, and achieve remote code execution (RCE) via web shell deployment.

Vulnerability Mechanics: Query Sanitization & Interpretation Breakdown

The primary vulnerability (CVE-2026-60137) resides within WordPress Core's wp-includes/class-wp-query.php and the low-level database interaction layer wp-includes/class-wpdb.php.

WordPress utilizes the wpdb::prepare() method to construct parameterized SQL queries using vsprintf-style formatting specifiers (such as %s, %d, and %f). In affected versions prior to the security releases, a logical interpretation conflict (CVE-2026-63030) occurred when handling nested query arguments supplied via public REST API endpoints or search query parameters:

// Vulnerable query parameter evaluation sequence in WP_Query
public function parse_query( $query = '' ) {
    // Parser allows multidimensional array input without recursive validation
    if ( isset( $query['orderby'] ) && is_array( $query['orderby'] ) ) {
        foreach ( $query['orderby'] as $key => $direction ) {
            // Insufficient validation allows raw SQL clauses to bypass sanitization regex
            $this->order_by_clauses[] = "{$key} {$direction}";
        }
    }
}

When complex nested arrays or URL-encoded parameter delimiters were supplied in the orderby or custom taxonomy parameters, the internal regex sanitizer failed to match SQL injection tokens that utilized alternative whitespace encodings or nested comment sequences (e.g., /**/). Consequently, the query compiler concatenated unsanitized user input directly into the ORDER BY or HAVING clauses of the generated MySQL/MariaDB query:

GET /wp-json/wp/v2/posts?orderby[title/**/AND/**/(SELECT/**/1/**/FROM/**/(SELECT/**/COUNT(*),CONCAT((SELECT/**/user_pass/**/FROM/**/wp_users/**/WHERE/**/ID=1),FLOOR(RAND(0)*2))x/**/FROM/**/information_schema.tables/**/GROUP/**/BY/**/x)a)]=ASC HTTP/1.1
Host: blog.enterprise.corp
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept: application/json

This injection primitive enables unauthenticated attackers to execute arbitrary Boolean-based blind, time-based blind, or error-based SQL queries against the underlying database engine, completely bypassing WordPress authentication mechanisms.

Exploitation Lifecycle & Post-Compromise Activity

Security operations centers (SOCs) monitoring in-the-wild attack telemetry have identified a structured exploitation playbook deployed by automated threat actors:

1. Database Enumeration & Hash Extraction: The adversary uses automated SQL injection scripts to extract the admin password hash (user_pass) and cryptographic authentication cookies from the wp_users and wp_usermeta tables.
2. Unauthorized Superuser Insertion: Attackers execute secondary INSERT statements or leverage session hijacking primitives to inject a new user into wp_users with user_login = 'wp_audit_adm' and set their capabilities in wp_usermeta to a:1:{s:13:"administrator";b:1;}.
3. Plugin Upload & Web Shell Persistence: Logging into the administrative dashboard (/wp-admin/) with the forged credentials, the adversary uploads a zip archive disguised as a legitimate caching or SEO plugin containing an obfuscated PHP web shell (e.g., WSO, FilesMan, or customized C2 beacons).
4. Server & Cloud Environment Reconnaissance: With PHP code execution established, the attacker reads wp-config.php to harvest database credentials, dumps cloud instance metadata (AWS IMDSv2, Azure MSI), and scans internal enterprise networks.

Affected Branches & Patch Baseline Matrix

Defensive Playbook & Emergency Hardening Checklist

Website administrators, DevSecOps teams, and hosting providers must execute the following remediation measures immediately:

1. Immediate WordPress Core Update via WP-CLI

Deploy updates across all managed WordPress installations using the official command-line interface:

# Check current WordPress version
wp core version --path=/var/www/html

# Update WordPress core to the latest patched release
wp core update --path=/var/www/html

# Verify database schema integrity
wp core update-db --path=/var/www/html

2. Web Application Firewall (WAF) Rule Deployment

Enforce ModSecurity, AWS WAF, or Cloudflare WAF managed rules to block SQL injection payloads targeting WordPress REST API endpoints and query parameters:

# ModSecurity rule example for blocking suspicious orderby SQL constructs
SecRule REQUEST_URI "@contains /wp-json/wp/v2/" \
    "id:1000045,phase:2,deny,status:403,log,msg:'WordPress Core SQLi Attempt in REST API',\
    chain"
SecRule ARGS_NAMES "@rx (?i)orderby["

3. Audit Active Users and Installed Plugins

Scan the WordPress user database for unauthorized administrator accounts created during the vulnerability window:

# List all users with administrator privileges
wp user list --role=administrator --path=/var/www/html

# Verify file integrity of all WordPress core files against official checksums
wp core verify-checksums --path=/var/www/html

# Inspect active plugins for unauthorized additions
wp plugin list --path=/var/www/html

4. Database Least-Privilege Configuration

Restrict database user privileges defined in wp-config.php. The database user should not possess global administrative privileges (such as FILE, SUPER, or GRANT OPTION) on MySQL/MariaDB instances, preventing attackers from writing arbitrary files directly to the web root via SQL injection.