Skip to content
NewA calmer, faster ZeroHour
VulnerabilityKEV2

CVE-2026-60137

WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)

CISA: WordPress Core SQL Injection Vulnerability

CVSS 3.1
5.9 medium
EPSS
5%p93
Published
·
Added to KEV
Analyze CVE-2026-60137 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

WordPress Core versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize the author__not_in parameter of WP_Query, resulting in a SQL injection flaw (CWE-89). The flaw is triggered only when a plugin or theme passes untrusted input to that parameter, so exploitability depends on the plugins and themes each site runs rather than affecting all sites equally. A successful attack allows a remote, unauthenticated attacker to inject SQL and read sensitive database contents such as credentials and post data (CVSS 3.1 scores the confidentiality impact as high, with no direct integrity or availability impact). All WordPress sites running the affected branches are exposed to the vulnerable code, with the directly exploitable subset determined by which plugins or themes feed untrusted input into author__not_in. The issue was added to CISA's KEV catalog on 2026-07-21, and news coverage describes in-the-wild exploitation as part of a 'wp2shell' RCE chain with CVE-2026-63030, with a public exploit reportedly fueling mass scanning; EPSS assigns a 78.3% probability of exploitation within 30 days (100th percentile).

What to do: Upgrade WordPress Core to 6.8.6, 6.9.5, or 7.0.2 (or later) immediately; KEV inclusion invokes CISA BOD 26-04 patching timelines, with priority for internet-facing sites. Audit installed plugins and themes for code that passes untrusted or user-controlled input to the author__not_in WP_Query parameter, and review web/database logs for anomalous queries or exploitation attempts, particularly chaining with CVE-2026-63030 in the reported wp2shell RCE chain.

ProductAffected
WordPress Core6.8.x before 6.8.6; 6.9.x before 6.9.5; 7.0.x before 7.0.2
Estimated exposure
masstens of millions of WordPress sites running the 6.8.x–7.0.x branches (WordPress core powers ~43% of the web) — WordPress core runs on roughly 43% of all websites (hundreds of millions of sites) and the 6.8–7.0 branches are recent major versions widely deployed per typical adoption patterns, so the vulnerable install base is plausibly in the tens of…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

KEVCISA Known Exploited Vulnerability
Affected
WordPress Core
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Due date
Ransomware use
Unknown
Vendors
wordpress
Products
wordpress
Ecosystems
WordPress
Weakness
CWE-89
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVE.org CISA KEV GitHub PoCs EPSS (5.3%)

In the news

20 stories