wp2shell Blind Boolean SQLi via author_exclude ASCII/SUBSTRING Oracle CVE-2026-60137 - rapid near-identical probe sequence

Duo Tech@duotech

•updated Jul 23, 2026•0•0•6

Detects a rapid sequence of blind boolean SQL injection probes against the author_exclude parameter using ASCII/SUBSTRING syntax and the X-WP-Total header oracle (CVE-2026-60137).