wp2shell: first signs of exploitation; CVE-2026-60137 lands

Two updates since the July 18 wp2shell brief, both flagged as pending in that filing, both now landed.

Update 1 — in-the-wild exploitation. Security firm watchTowr, quoted in BleepingComputer’s July 18 coverage, says the crew is “beginning to see the first signs of in-the-wild exploitation.” Confidence: first-signs, single named vendor, not yet corroborated by a second vendor telemetry source. Not “widespread exploitation confirmed.” Not “campaign attributed.” First signs. Treat accordingly.

Update 2 — companion CVE ID. The persistent-companion tracking has resolved to CVE-2026-60137, an SQL injection in the author__not_in parameter of WP_Query. Verified independently against NVD: CVSS 5.9 (medium), published July 17. Confidence: confirmed and independently verified.

What CVE-2026-60137 actually is

Per NVD, the flaw is that WP_Query “does not properly sanitise the author__not_in parameter,” which “could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.” Two structural notes:

• This is not a second RCE. SQLi at CVSS 5.9 is not the same primitive as the CVE-2026-63030 unauthenticated RCE and does not chain to code execution on its own.
• It is plugin/theme-mediated. Untrusted input has to reach author__not_in. Sites running only unpatched WordPress Core with no plugin or theme that pipes user input into that parameter are not directly in range for this one.

Per BleepingComputer, CVE-2026-60137 also touches the 6.8 branch, which the RCE-only wp2shell does not. That is the one meaningful reason to care about 60137 as more than a footnote: it extends the patched-version floor backwards into 6.8.x, which the July 18 brief did not.

Exact affected and patched versions

Both CVEs, consolidated from BleepingComputer’s July 18 write-up and the wordpress.org 7.0.2 release note:

• CVE-2026-63030 (RCE, CVSS 9.8, critical). In range: WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1. Patched: 6.9.5 or 7.0.2.
• CVE-2026-60137 (SQLi, CVSS 5.9, medium). In range: WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1. Patched: 6.8.6, 6.9.5, or 7.0.2.

Attribution: both flaws reported by Adam Kues of Searchlight Cyber.

What changed for defenders

Nothing about the July 18 patch call has softened. In order of priority:

• RCE first, still. If you have not yet updated to 6.9.5 or 7.0.2 on any 6.9.x or 7.0.x public-facing instance, that is the compromise-scale action item. The first-signs IITW report shortens the window; it does not change the response.
• 6.8.x is now a live patch call too. Update 6.8.x instances to 6.8.6 if they run any plugin or theme that could pass user input into author__not_in. Without a definitive audit of plugin/theme code, treat this as the working assumption for any 6.8.x instance with a non-trivial plugin surface.
• KEV status. Neither CVE has been added to the CISA Known Exploited Vulnerabilities catalog at the time of this filing. With a named vendor reporting first-signs exploitation and a public PoC on the RCE, a KEV entry on CVE-2026-63030 would compress the federal-civilian patch timeline to days under BOD 26-04. Watch for it.

Confidence summary

• CVE-2026-63030 RCE, patched versions, PoC public — confirmed and independently verified.
• CVE-2026-60137 SQLi, patched versions, medium severity — confirmed and independently verified against NVD.
• First-signs in-the-wild exploitation of CVE-2026-63030 — as-reported by watchTowr, single named vendor, not yet corroborated.
• Widespread/mass exploitation — unconfirmed. Treat accordingly.
• KEV addition — none at time of filing.

Related CVE stubs on this site: CVE-2026-63030 and CVE-2026-60137. Vendor hub: WordPress.

Sources

• BleepingComputer: WordPress Core “wp2shell” RCE flaws get public exploits, patch now — July 18, 2026.
• NVD: CVE-2026-60137 and CVE-2026-63030.
• WordPress: WordPress 7.0.2 release announcement.