[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-60137":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-22T20:44:10.849Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":44,"aliases":68,"duplicate_of":9,"upstream":70,"downstream":71,"duplicates":73,"related":74,"reserved_at":9,"published_at":75,"modified_at":76,"state":77,"summary":78,"references_raw":88,"kevs":114,"epss":125,"epss_history":128,"metrics":222,"affected":232},"CVE-2026-60137","WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-89","Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.","weakness","Stable","Base","High",[20,24,28,32,36,40],{"id":21,"name":22,"techniques":23},"CAPEC-108","Command Line Execution through SQL Injection",[],{"id":25,"name":26,"techniques":27},"CAPEC-109","Object Relational Mapping Injection",[],{"id":29,"name":30,"techniques":31},"CAPEC-110","SQL Injection through SOAP Parameter Tampering",[],{"id":33,"name":34,"techniques":35},"CAPEC-470","Expanding Control over the Operating System from the Database",[],{"id":37,"name":38,"techniques":39},"CAPEC-66","SQL Injection",[],{"id":41,"name":42,"techniques":43},"CAPEC-7","Blind SQL Injection",[],[45],{"_key":46,"name":47,"source":48,"url":49,"maturity":50,"reliability_score":51,"verified":52,"type":53,"platforms":54,"requires_auth":52,"exploitdb":9,"metasploit":55},"MSF_EXPLOIT_MULTI_HTTP_WP_BATCH_DESYNC_RCE","WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE","metasploit","https://github.com/rapid7/metasploit-framework/blob/master/modules/exploit/multi/http/wp_batch_desync_rce.rb","weaponized",1,true,"remote",[],{"fullname":56,"rank":57,"rank_name":58,"post_auth":52,"check":52,"notes":59},"exploit/multi/http/wp_batch_desync_rce",600,"excellent",{"Stability":60,"SideEffects":62,"Reliability":66},[61],"crash-safe",[63,64,65],"ioc-in-logs","artifacts-on-disk","config-changes",[67],"repeatable-session",[69],"DEBIAN-CVE-2026-60137",[],[72],{"_key":69},[],[],"2026-07-17T19:14:12.159Z","2026-07-29T19:26:43.785Z","Analyzed",{"cisa_kev":52,"cisa_ransomware":79,"cisa_vendor":80,"epss_severity":81,"epss_score":82,"severity":83,"severity_score":84,"severity_version":85,"severity_source":86,"severity_vector":87,"severity_status":77},false,"WordPress","critical",0.731,"medium",5.9,"v3.1","cve.org","CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",[89,97,102,108],{"url":90,"sources":91,"tags":93},"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf",[86,92],"nvd",[94,95,96],"VDB Entry","Technical Description","Vendor Advisory",{"url":98,"sources":99,"tags":100},"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/",[86,92],[101,96],"Release Notes",{"url":103,"sources":104,"tags":105},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137",[86,92],[106,107],"Government Resource","US Government Resource",{"url":109,"sources":110,"tags":112},"https://security-tracker.debian.org/tracker/CVE-2026-60137",[111],"osv_debian",[113],"Advisory",[115],{"source":116,"vendor":80,"product":117,"date_added":118,"vulnerability_name":119,"short_description":120,"required_action":121,"due_date":122,"known_ransomware_campaign_use":123,"notes":124,"exploitation_type":9},"cisa","Core","2026-07-21","WordPress Core SQL Injection Vulnerability","WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-08-04","Unknown","https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137",{"date":126,"score":82,"percentile":127},"2026-08-22",0.99413,[129,133,136,139,141,145,148,152,155,158,160,162,164,168,171,173,175,177,178,180,182,185,188,190,192,195,198,201,204,207,209,211,213,216,219,221],{"date":130,"score":131,"percentile":132},"2026-07-18",0.04026,0.89446,{"date":134,"score":131,"percentile":135},"2026-07-19",0.89451,{"date":137,"score":131,"percentile":138},"2026-07-20",0.89467,{"date":118,"score":131,"percentile":140},0.89474,{"date":142,"score":143,"percentile":144},"2026-07-22",0.20395,0.97219,{"date":146,"score":143,"percentile":147},"2026-07-23",0.9722,{"date":149,"score":150,"percentile":151},"2026-07-24",0.77974,0.99525,{"date":153,"score":150,"percentile":154},"2026-07-25",0.99526,{"date":156,"score":150,"percentile":157},"2026-07-26",0.99527,{"date":159,"score":150,"percentile":157},"2026-07-27",{"date":161,"score":150,"percentile":157},"2026-07-28",{"date":163,"score":150,"percentile":157},"2026-07-29",{"date":165,"score":166,"percentile":167},"2026-07-30",0.79029,0.99558,{"date":169,"score":166,"percentile":170},"2026-07-31",0.99559,{"date":172,"score":166,"percentile":167},"2026-08-01",{"date":174,"score":166,"percentile":167},"2026-08-02",{"date":176,"score":166,"percentile":170},"2026-08-03",{"date":122,"score":166,"percentile":170},{"date":179,"score":166,"percentile":170},"2026-08-05",{"date":181,"score":166,"percentile":170},"2026-08-06",{"date":183,"score":166,"percentile":184},"2026-08-07",0.9956,{"date":186,"score":82,"percentile":187},"2026-08-08",0.99404,{"date":189,"score":82,"percentile":187},"2026-08-09",{"date":191,"score":82,"percentile":187},"2026-08-10",{"date":193,"score":82,"percentile":194},"2026-08-11",0.99405,{"date":196,"score":82,"percentile":197},"2026-08-12",0.99406,{"date":199,"score":82,"percentile":200},"2026-08-13",0.99407,{"date":202,"score":82,"percentile":203},"2026-08-14",0.99408,{"date":205,"score":82,"percentile":206},"2026-08-15",0.99409,{"date":208,"score":82,"percentile":206},"2026-08-16",{"date":210,"score":82,"percentile":206},"2026-08-17",{"date":212,"score":82,"percentile":206},"2026-08-18",{"date":214,"score":82,"percentile":215},"2026-08-19",0.99411,{"date":217,"score":82,"percentile":218},"2026-08-20",0.99412,{"date":220,"score":82,"percentile":127},"2026-08-21",{"date":126,"score":82,"percentile":127},[223,228,230],{"source":86,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":224,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":225,"vectorString":87,"impactScore":226,"exploitabilityScore":227},"MEDIUM",6,5.6,{"source":92,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":229,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":225,"vectorString":87,"impactScore":226,"exploitabilityScore":227},{"source":111,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":231,"cvss_v4_0":9},{"baseScore":84,"baseSeverity":9,"vectorString":87,"impactScore":226,"exploitabilityScore":227},[233,247],{"ecosystem":234,"name":235,"vendor":236,"product":235,"cpe_part":9,"purl_type":237,"purl_namespace":236,"purl_name":235,"source":9,"versions":238},"Debian","wordpress","debian","deb",[239,244],{"version":240,"is_range":52,"range_type":241,"version_start":9,"version_start_type":9,"version_end":242,"version_end_type":243,"fixed_in":9},"lt6_8_6+dfsg1_0+deb13u1","ecosystem","6.8.6+dfsg1-0+deb13u1","excluding",{"version":245,"is_range":52,"range_type":241,"version_start":9,"version_start_type":9,"version_end":246,"version_end_type":243,"fixed_in":9},"lt7_0_2+dfsg1_1","7.0.2+dfsg1-1",{"ecosystem":9,"name":80,"vendor":235,"product":235,"cpe_part":248,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":249},"a",[250,255,259,263,267,270],{"version":251,"is_range":52,"range_type":86,"version_start":252,"version_start_type":253,"version_end":254,"version_end_type":243,"fixed_in":9},">= 6.8.0, \u003C 6.8.6","6.8.0","including","6.8.6",{"version":256,"is_range":52,"range_type":86,"version_start":257,"version_start_type":253,"version_end":258,"version_end_type":243,"fixed_in":9},">= 6.9.0, \u003C 6.9.5","6.9.0","6.9.5",{"version":260,"is_range":52,"range_type":86,"version_start":261,"version_start_type":253,"version_end":262,"version_end_type":243,"fixed_in":9},">= 7.0.0, \u003C 7.0.2","7.0.0","7.0.2",{"version":264,"is_range":52,"range_type":265,"version_start":266,"version_start_type":253,"version_end":254,"version_end_type":243,"fixed_in":9},"gte6.8_lt6.8.6","cpe","6.8",{"version":268,"is_range":52,"range_type":265,"version_start":269,"version_start_type":253,"version_end":258,"version_end_type":243,"fixed_in":9},"gte6.9_lt6.9.5","6.9",{"version":271,"is_range":52,"range_type":265,"version_start":272,"version_start_type":253,"version_end":262,"version_end_type":243,"fixed_in":9},"gte7.0_lt7.0.2","7.0"]