https://detection.fyi/tags/cve.2026-60137/ Recent content in cve.2026-60137 on Detection.FYI Hugo -- gohugo.io Mon, 20 Jul 2026 12:43:48 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/exploits/cve-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent/ Mon, 20 Jul 2026 12:43:48 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/exploits/cve-2026-63030/web_exploit_cve_2026_63030_wp2shell_tool_useragent/ Detects the hardcoded "wp2shell" User-Agent string used by the wp2shell PoC tool during all phases of CVE-2026-63030 and CVE-2026-60137 exploitation. https://detection.fyi/sigmahq/sigma/emerging-threats/2026/exploits/cve-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse/ Mon, 20 Jul 2026 12:43:48 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/exploits/cve-2026-63030/web_exploit_cve_2026_63030_batch_rest_route_abuse/ Detects exploitation attempts against the WordPress REST batch endpoint (CVE-2026-63030, CVE-2026-60137) using the wp2shell PoC tool. The tool sends POST requests to the batch endpoint via the ?rest_route=/batch/v1 query parameter, covering all attack phases from initial probe through SQL injection and pre-auth admin creation. A 207 response confirms the endpoint is active on the target. https://detection.fyi/sigmahq/sigma/emerging-threats/2026/exploits/cve-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access/ Mon, 20 Jul 2026 12:43:48 +0000 https://detection.fyi/sigmahq/sigma/emerging-threats/2026/exploits/cve-2026-63030/web_exploit_cve_2026_63030_webshell_plugin_access/ Detects post-exploitation access to the wp2shell webshell plugin dropped after successful exploitation of CVE-2026-63030 and CVE-2026-60137. After the pre-auth SQLi-to-admin bridge is established, the attacker can upload a malicious plugin (wp2shell) to the target WordPress instance. At this phase, the attacker accesses the webshell for command execution and persistence.