{"schema":"vulnpedia.poc/1","cve":"CVE-2026-60137","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2026-07-21","ransomware":false},"epss":{"score":0.05323,"percentile":0.92551},"cvss":{"version":"3.1","score":5.9,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"},"has_public_poc":true,"poc_sources":[{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb","executable":true,"sourceId":"exploit/multi/http/wp_batch_desync_rce","description":"WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","verification":"catalogued","source":"metasploit","modified":"2026-08-06 12:35:36 +0000","origins":[{"source":"metasploit","sourceId":"exploit/multi/http/wp_batch_desync_rce","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb"},{"source":"metasploit","sourceId":"exploit/multi/http/wp_batch_desync_rce","modified":"2026-08-06 12:35:36 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb"}]},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/0cb204211eff","executable":false,"sourceId":"0cb204211eff","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0cb204211eff","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/0cb204211eff"}],"repositoryUrl":"https://github.com/0xsha/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/226a2304a8c3","executable":false,"sourceId":"226a2304a8c3","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"226a2304a8c3","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/226a2304a8c3"}],"repositoryUrl":"https://github.com/Senanfurkan/wordpress-cve-2026-63030"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/d4aa0c56e46f","executable":false,"sourceId":"d4aa0c56e46f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"d4aa0c56e46f","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/d4aa0c56e46f"}],"repositoryUrl":"https://github.com/h4cd0c/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/7d1ac62804c2","executable":false,"sourceId":"7d1ac62804c2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"7d1ac62804c2","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/7d1ac62804c2"}],"repositoryUrl":"https://github.com/47Cid/wp2shell-lab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/1a4e9efa24b2","executable":false,"sourceId":"1a4e9efa24b2","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1a4e9efa24b2","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/1a4e9efa24b2"}],"repositoryUrl":"https://github.com/ekomsSavior/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/78ce91ae2a55","executable":false,"sourceId":"78ce91ae2a55","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"78ce91ae2a55","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/78ce91ae2a55"}],"repositoryUrl":"https://github.com/0xWhoknows/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/e4157426ef4d","executable":false,"sourceId":"e4157426ef4d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e4157426ef4d","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/e4157426ef4d"}],"repositoryUrl":"https://github.com/Icex0/wp2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/e2c2a89ee1a1","executable":false,"sourceId":"e2c2a89ee1a1","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e2c2a89ee1a1","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/e2c2a89ee1a1"}],"repositoryUrl":"https://github.com/dinosn/wp2shell-lab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/4b2de6418d11","executable":false,"sourceId":"4b2de6418d11","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"4b2de6418d11","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/4b2de6418d11"}],"repositoryUrl":"https://github.com/yoerivegt/wp2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/474f98ad41b0","executable":false,"sourceId":"474f98ad41b0","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"474f98ad41b0","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/474f98ad41b0"}],"repositoryUrl":"https://github.com/securelayer7/WordPresShell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/353ec0331b42","executable":false,"sourceId":"353ec0331b42","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"353ec0331b42","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/353ec0331b42"}],"repositoryUrl":"https://github.com/ikow/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/d25894558c3a","executable":false,"sourceId":"d25894558c3a","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"d25894558c3a","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/d25894558c3a"}],"repositoryUrl":"https://github.com/bahartanir/wp2shell-scanner"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/7aadbc15707f","executable":false,"sourceId":"7aadbc15707f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"7aadbc15707f","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/7aadbc15707f"}],"repositoryUrl":"https://github.com/JohenLastGen-JLG/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/4bf1d8157b51","executable":false,"sourceId":"4bf1d8157b51","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"4bf1d8157b51","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/4bf1d8157b51"}],"repositoryUrl":"https://github.com/Crypto-Cat/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/dff8db34058c","executable":false,"sourceId":"dff8db34058c","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"dff8db34058c","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/dff8db34058c"}],"repositoryUrl":"https://github.com/hidden-investigations/wp2shell-scanner"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/5f03cb94af76","executable":false,"sourceId":"5f03cb94af76","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"5f03cb94af76","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/5f03cb94af76"}],"repositoryUrl":"https://github.com/SentinelXofficial/sxwp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/97709737ec53","executable":false,"sourceId":"97709737ec53","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"97709737ec53","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/97709737ec53"}],"repositoryUrl":"https://github.com/lucifer0xf/wp2shell-Wordpress-TOWN"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/09cb4f5a2c2c","executable":false,"sourceId":"09cb4f5a2c2c","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"09cb4f5a2c2c","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/09cb4f5a2c2c"}],"repositoryUrl":"https://github.com/Bhanunamikaze/WP2Shell-CVE-2026-63030-POC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/f2f54ce3e993","executable":false,"sourceId":"f2f54ce3e993","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"f2f54ce3e993","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/f2f54ce3e993"}],"repositoryUrl":"https://github.com/mcipekci/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/3c9b621bdac9","executable":false,"sourceId":"3c9b621bdac9","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3c9b621bdac9","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/3c9b621bdac9"}],"repositoryUrl":"https://github.com/Colere-Sys/wp2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/d3f711daf1da","executable":false,"sourceId":"d3f711daf1da","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"d3f711daf1da","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/d3f711daf1da"}],"repositoryUrl":"https://github.com/gagaltotal/CVE-2026-63030-CVE-2026-60137-wp2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/ca529c35966e","executable":false,"sourceId":"ca529c35966e","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"ca529c35966e","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/ca529c35966e"}],"repositoryUrl":"https://github.com/wn-iqbal/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/f489267fbeea","executable":false,"sourceId":"f489267fbeea","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"f489267fbeea","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/f489267fbeea"}],"repositoryUrl":"https://github.com/shinthink/CVE-2026-63030"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/cf809f79dd13","executable":false,"sourceId":"cf809f79dd13","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"cf809f79dd13","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/cf809f79dd13"}],"repositoryUrl":"https://github.com/Giangdurian/CVE-2026-63030-CVE-2026-60137"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/7d44b20ca038","executable":false,"sourceId":"7d44b20ca038","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"7d44b20ca038","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/7d44b20ca038"}],"repositoryUrl":"https://github.com/yuag/wp2shell"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/6ffd09f55538","executable":false,"sourceId":"6ffd09f55538","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"6ffd09f55538","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/6ffd09f55538"}],"repositoryUrl":"https://github.com/northsia/CVE-2026-60137-With-Skip-SSL"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/61645873641f","executable":false,"sourceId":"61645873641f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"61645873641f","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/61645873641f"}],"repositoryUrl":"https://github.com/AdarshThakur14777-cyber/CVE-2026-60137"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/aacebc68216d","executable":false,"sourceId":"aacebc68216d","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"aacebc68216d","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/aacebc68216d"}],"repositoryUrl":"https://github.com/johnlodan/wp2shell-rce"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/43bc49db3c7b","executable":false,"sourceId":"43bc49db3c7b","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"43bc49db3c7b","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/43bc49db3c7b"}],"repositoryUrl":"https://github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/68469fc185b9","executable":false,"sourceId":"68469fc185b9","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"68469fc185b9","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/68469fc185b9"}],"repositoryUrl":"https://github.com/M4xSec/wp2shell-Exploit-Waf-Bypass"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/d5051e1b946b","executable":false,"sourceId":"d5051e1b946b","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"d5051e1b946b","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/d5051e1b946b"}],"repositoryUrl":"https://github.com/DeadExpl0it/wp2shell-poc"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/3e923a05b99e","executable":false,"sourceId":"3e923a05b99e","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"3e923a05b99e","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/3e923a05b99e"}],"repositoryUrl":"https://github.com/fl0ydsec/CVE-2026-63030"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/93cd00b87991","executable":false,"sourceId":"93cd00b87991","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"93cd00b87991","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/93cd00b87991"}],"repositoryUrl":"https://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/1def4aa2196f","executable":false,"sourceId":"1def4aa2196f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1def4aa2196f","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/1def4aa2196f"}],"repositoryUrl":"https://github.com/MRdark-ops/WP2Shell--CVE-2026-63030-CVE-2026-60137-"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/b743b83f252f","executable":false,"sourceId":"b743b83f252f","verification":"catalogued","source":"vulncheck-kev","modified":"2026-07-17T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"b743b83f252f","modified":"2026-07-17T00:00:00Z","url":"https://vulncheck.com/xdb/b743b83f252f"}],"repositoryUrl":"https://github.com/0xCyp1337/CVE-2026-63030-CVE-2026-60137-WP2SHELL"}],"poc_candidates":[{"url":"https://github.com/h4cd0c/wp2shell","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.","modified":"2026-07-18T16:41:06Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/h4cd0c/wp2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-07-18T16:41:06Z","url":"https://github.com/h4cd0c/wp2shell"}],"tags":[]},{"url":"https://github.com/codeb0ssx/Ultimate-wp2shell","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"wp2shell — Pre-authentication RCE in WordPress Core (CVE-2026-60137 + CVE-2026-63030). Chains an SQL injection in author__not_in with batch-route confusion for unauthenticated remote code execution on WP 6.9.0–6.9.4 / 7.0.0–7.0.1.","modified":"2026-08-09T13:01:37Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/codeb0ssx/Ultimate-wp2shell"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-08-09T13:01:37Z","url":"https://github.com/codeb0ssx/Ultimate-wp2shell"}],"tags":[]},{"url":"https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"CVE-2026-60137Temporary Emergency Mitigation for CVE-2026-60137 & CVE-2026-63030 (wp2shell)","modified":"2026-07-21T17:49:07Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-07-21T17:49:07Z","url":"https://github.com/mrmtwoj/Fix-CVE-2026-60137-CVE-2026-63030-in-wordpress"}],"tags":[]},{"url":"https://github.com/Colere-Sys/wp2shell-poc","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"Analysis and end-to-end implementation of the patched wordpress RCE vulnerability - CVE-2026-60137 and CVE-2026-63030","modified":"2026-10-15T01:23:42Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/Colere-Sys/wp2shell-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-10-15T01:23:42Z","url":"https://github.com/Colere-Sys/wp2shell-poc"}],"tags":[]},{"url":"https://github.com/northsia/CVE-2026-60137-With-Skip-SSL","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"Adding --insecure to skip ssl","modified":"2026-07-26T11:53:40Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/northsia/CVE-2026-60137-With-Skip-SSL"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-07-26T11:53:40Z","url":"https://github.com/northsia/CVE-2026-60137-With-Skip-SSL"}],"tags":[]},{"url":"https://github.com/Dungsocool/CVE-2026-60137_CVE-2026-63030","source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-07-27T04:11:11Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/Dungsocool/CVE-2026-60137_CVE-2026-63030"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-07-27T04:11:11Z","url":"https://github.com/Dungsocool/CVE-2026-60137_CVE-2026-63030"}],"tags":[]},{"url":"https://github.com/michael-kanda/Wp2shell-ioc-scanner","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"Read-only-by-default WordPress incident-response scanner for the “wp2shell” attack chain (CVE-2026-60137 / CVE-2026-63030): detects shadow-admin, database and filesystem IOCs, verifies core integrity, and exports evidence. Optional controlled account cleanup; does not remove malware.","modified":"2026-08-03T11:21:46Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/michael-kanda/Wp2shell-ioc-scanner"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-08-03T11:21:46Z","url":"https://github.com/michael-kanda/Wp2shell-ioc-scanner"}],"tags":[]},{"url":"https://github.com/AdarshThakur14777-cyber/CVE-2026-60137","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"wpsqli  full SQLi extractor + dumper for CVE-2026-60137","modified":"2026-08-03T08:55:46Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/AdarshThakur14777-cyber/CVE-2026-60137"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-08-03T08:55:46Z","url":"https://github.com/AdarshThakur14777-cyber/CVE-2026-60137"}],"tags":[]},{"url":"https://github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC","source":"poc-in-github","sourceId":"CVE-2026-60137","description":"Non-destructive proof-of-concept and verification harness for CVE-2026-60137, a blind SQL injection in WordPress core (`WP_Query::author__not_in`), reachable via the REST API's `author_exclude` parameter.","modified":"2026-08-05T00:16:17Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-08-05T00:16:17Z","url":"https://github.com/AbdullahMaqbool22/CVE-2026-60137-WordPress-Core-SQL-Injection-PoC"}],"tags":[]},{"url":"https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030","source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-09-10T07:22:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-09-10T07:22:49Z","url":"https://github.com/ivanesk315/CVE-2026-60137-and-CVE-2026-63030"}],"tags":[]},{"url":"https://github.com/BIBILZERODAY/CVE-2026-60137---WordPress-Core-Critical-SQL-Injection-SQLi-PoC","source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-10-16T20:38:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-60137","url":"https://github.com/BIBILZERODAY/CVE-2026-60137---WordPress-Core-Critical-SQL-Injection-SQLi-PoC"},{"source":"poc-in-github","sourceId":"CVE-2026-60137","modified":"2026-10-16T20:38:55Z","url":"https://github.com/BIBILZERODAY/CVE-2026-60137---WordPress-Core-Critical-SQL-Injection-SQLi-PoC"}],"tags":[]}],"test_commands":[{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2026-60137/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2026-60137%22&type=repositories","executable":false}]}