CVE-2026-60137Vulnerability

1. “The exploitation chain leverages two WordPress Core vulnerabilities CVE-2026-63030 and CVE-2026-60137 which can be chained to transition from an unauthenticated attack condition to arbitrary code execution on affected WordPress 6.9.x and 7.0.x installations.”

   Seqrite LabsVendor16 Oct 2026
   WP2Shell Exploit Chain: Anatomy of a Sophisticated WordPress Attack

2. “Attackers can chain it with CVE-2026-60137 to achieve SQL injection and potentially remote code execution (RCE).”

   CybleVendor14 Oct 2026
   The Week in Vulnerabilities: Toptech, Lantronix, Langflow, and CISA Malcolm Flaws

3. “CVE-2026-60137”

   Recorded FutureVendor13 Oct 2026
   September 2026 CVE Landscape

4. “The global campaign specifically focuses on known security flaws like wp2shell (CVE-2026-63030 and CVE-2026-60137) and CVE-2026-4815, an SQL injection vulnerability impacting the Support Board WordPress plugin, to seize control of WordPress sites.”

   The Hacker NewsNews12 Oct 2026
   CyberXero Uses Claude Code in Campaign That Stole Over 628,000 Ukrainian Records

5. “… RAT has been observed in two other campaigns since July 2026: one involving the exploitation of WordPress flaws (CVE-2026-63030 and CVE-2026-60137, aka wp2shell) and a macOS campaign in which a fake Zoom installer is used to deploy the RAT.”

   The Hacker NewsNews7 Oct 2026
   Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

6. “CVE-2026-60137”

   SOCRadarVendor6 Oct 2026
   CyberXero: An AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure

7. “CVE-2026-60137”

   GreyNoiseVendor21 Sep 2026
   Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

8. “The interface groups targets under five named exploitation chains: react2shell (CVE-2025-55182), wp2shell (CVE-2026-63030 and CVE-2026-60137), xss2shell (CVE-2026-64638), joomla2shell (CVE-2026-48907), and deep.”

   Datadog Security LabsVendor18 Sep 2026
   Attacker infrastructure, but vibe-coded: tracking the evolution of credential harvesting platforms

9. “…henticated SQL injection: REST batch route confusion (CVE-2026-63030) chained with the WP_Query author__not_in string interpolation (CVE-2026-60137).”

   Rapid7Vendor28 Aug 2026
   Metasploit Wrap Up: Payloads and Exploits, and Scanners, Oh my!

10. “CVE-2026-60137”

    Recorded FutureVendor7 Aug 2026
    July 2026 CVE Landscape

11. “… 17, 2026, Searchlight Cyber disclosed wp2shell, a pre-authentication remote code execution chain in WordPress Core (CVE-2026-63030, CVE-2026-60137).”

    Elastic Security LabsVendor23 Jul 2026
    wp2shell hits WordPress: detecting pre-auth RCE from plugin drop to command execution

12. “The second, CVE-2026-60137, is a high-severity author__not_in WP_Query SQL injection (CVSS rating: 5.9) affecting WordPress Core versions 6.8.x before 6.8.6, 6.9.x before 6.9.5 and 7.0.x before 7.0.2.”

    Infosecurity MagazineNews20 Jul 2026
    Researchers Build WordPress Exploit Using OpenAI's GPT

• wp2shell[.]comin 2 reports

Also named with it: CVE-2026-63030, CVE-2026-60004, CVE-2025-55182, CVE-2022-0847, CVE-2025-3248, CVE-2021-4034, CVE-2026-16232, CVE-2026-20316, CVE-2026-39987, CVE-2026-48907, CVE-2021-29441, CVE-2026-0257, CVE-2026-9198, CVE-2023-54391, CVE-2019-0708, CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, CVE-2026-7273