CVE-2026-60137

wpsqli - WordPress SQLi Extractor CVE-2026-60137 A fast, menu-driven database extraction tool exploiting the authornotin SQL injection vulnerability in WordPress core. This tool focuses purely on database enumeration and dumping, utilizing the REST batch route confusion CVE-2026-63030 to reach th...

CVE-2026-63030-POC

wp2shell — CVE-2026-63030 + CVE-2026-60137 WordPress RCE exploit chain. Unauthenticated. CVSS 9.8. Affected Versions Branch| Vulnerable| Patched ---|---|--- 6.9.x| 6.9.0 – 6.9.4| ≥ 6.9.5 7.0.x| 7.0.0 – 7.0.1| ≥ 7.0.2 The Chain Two CVEs chained into unauthenticated Remote Code Execution:...

CVE-2026-60137-WordPress-Core-SQL-Injection-PoC

CVE-2026-60137 — WordPress Core SQL Injection PoC Non-destructive proof-of-concept and verification harness for CVE-2026-60137 , a blind SQL injection in WordPress core WPQuery::authornotin, reachable via the REST API's authorexclude parameter. Root Cause WPQuery::getposts builds SQL by...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 + CVE-2026-60137 — WP2Shell Exploit WordPres...

abdal-cve-2026-60137

English | فارسی 🛡️ Abdal CVE-2026-60137 PoC Exploits Abdal CVE-2026-60137 is a defensive WordPress exposure verifier for the insufficient sanitization of the authornotin parameter in WPQuery, tracked as CVE-2026-60137. The vulnerability can allow SQL injection when untrusted input reaches the...

Exploit for SQL Injection in Wordpress

WP2Shell — Unauthenticated SQL Injection Proof of Concept C...

BIT-WORDPRESS-MULTISITE-2026-60137 WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

WP < 7.0.2 - Facilitated SQLi

Description WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

UBUNTU-CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-60137: Improper Neutralization of Special Elements used in an SQL Command

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter...

CVE-2026-63030: Interpretation Conflict

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the authornotin WPQuery SQL Injection CVE-2026-60137, could allow an attacker to perform SQL Injection and achieve Remote Code Execution...