WordPress REST author_exclude SQL Injection via Batch Desync (wp2shell CVE-2026-60137)

Duo Tech@duotech

•updated Jul 23, 2026•0•0•3

Detects SQL injection syntax smuggled into the author_exclude parameter via the WordPress REST API batch endpoint desync (CVE-2026-60137/CVE-2026-63030).