wp2shell UNION-based SQLi against WordPress REST posts item route via split_the_query bypass (CVE-2026-60137)

Duo Tech@duotech

•updated Jul 23, 2026•0•0•3

Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.