Vulnerability record · CVE-2026-60137 · published 17 July 2026
CVE-2026-60137: WordPress WP_Query author__not_in SQL injection
Wordpress · Wordpress
WordPress core fails to properly sanitise the author__not_in parameter of WP_Query in versions before 6.8.6, 6.9.5 and 7.0.2, allowing SQL injection when a plugin or theme passes untrusted input into that parameter. The flaw matters because WP_Query is widely used by third-party code, so exposure depends on how plugins and themes handle user-supplied data.
Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Automated analysis
critical priorityThe flaw is a SQL injection in widely deployed WordPress core code paths, listed in CISA KEV with a near-term remediation deadline and a very high EPSS score.
What it is
WordPress core fails to properly sanitise the author__not_in parameter of WP_Query in versions before 6.8.6, 6.9.5 and 7.0.2, allowing SQL injection when a plugin or theme passes untrusted input into that parameter. The flaw matters because WP_Query is widely used by third-party code, so exposure depends on how plugins and themes handle user-supplied data.
Impact
An attacker who can reach a vulnerable query path can inject SQL, potentially reading arbitrary database contents; the CVSS vector rates confidentiality impact as high with no integrity or availability impact.
Attack surface
Reachable over the network with no authentication and no user interaction per the CVSS vector, but only through a plugin or theme that forwards untrusted input to author__not_in; core alone does not expose the parameter to untrusted input.
Exploitation
CVE-2026-60137 was added to CISA KEV on 2026-07-21 with a 2026-08-04 remediation due date, and EPSS gives a 30-day probability of 0.78305 (99.556th percentile), indicating active exploitation. No ransomware campaign use is documented.
What to do
- Upgrade WordPress core to 6.8.6, 6.9.5 or 7.0.2 as applicable, following the vendor release notes.
- Inventory plugins and themes that build WP_Query arguments from request input and update or remove those that pass untrusted data to author__not_in.
- Apply the CISA KEV required actions, including BOD 26-04 prioritisation and forensics triage, and discontinue use where mitigations are unavailable.
- Add input validation or a WAF rule blocking SQL metacharacters in author__not_in-style query parameters until all components are patched.
Detection
- Review web server and WAF logs for requests containing author__not_in or author__not_in-style parameters with SQL syntax such as quotes, UNION, or comment sequences.
- Monitor database query logs for anomalous SELECT statements originating from WordPress query construction.
- Hunt for unexpected outbound or database read patterns following requests to plugin or theme endpoints that accept author filtering parameters.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalog on 21 July 2026 as "WordPress Core SQL Injection Vulnerability". Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Federal deadline 4 August 2026.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf | Vendor Advisory |
| https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ | Release Notes |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 | US Government Resource |
Track CVE-2026-60137 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2026-60137), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
