WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
CISA: WordPress Core SQL Injection Vulnerability
CVSS 3.1
5.9medium
EPSS
78%p100
Published
()
KEV added
AI analysis
WordPress Core versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize the author__not_in parameter of WP_Query, resulting in a SQL injection flaw (CWE-89). The flaw is triggered only when a plugin or theme passes untrusted input to that parameter, so exploitability depends on the plugins and themes each site runs rather than affecting all sites equally. A successful attack allows a remote, unauthenticated attacker to inject SQL and read sensitive database contents such as credentials and post data (CVSS 3.1 scores the confidentiality impact as high, with no direct integrity or availability impact). All WordPress sites running the affected branches are exposed to the vulnerable code, with the directly exploitable subset determined by which plugins or themes feed untrusted input into author__not_in. The issue was added to CISA's KEV catalog on 2026-07-21, and news coverage describes in-the-wild exploitation as part of a 'wp2shell' RCE chain with CVE-2026-63030, with a public exploit reportedly fueling mass scanning; EPSS assigns a 78.3% probability of exploitation within 30 days (100th percentile).
What to do: Upgrade WordPress Core to 6.8.6, 6.9.5, or 7.0.2 (or later) immediately; KEV inclusion invokes CISA BOD 26-04 patching timelines, with priority for internet-facing sites. Audit installed plugins and themes for code that passes untrusted or user-controlled input to the author__not_in WP_Query parameter, and review web/database logs for anomalous queries or exploitation attempts, particularly chaining with CVE-2026-63030 in the reported wp2shell RCE chain.
Affected
WordPress Core
6.8.x before 6.8.6; 6.9.x before 6.9.5; 7.0.x before 7.0.2
Estimated exposure
masstens of millions of WordPress sites running the 6.8.x–7.0.x branches (WordPress core powers ~43% of the web) — WordPress core runs on roughly 43% of all websites (hundreds of millions of sites) and the 6.8–7.0 branches are recent major versions widely deployed per typical adoption patterns, so the vulnerable install base is plausibly in the tens of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CISA Known Exploited Vulnerability
Affected
WordPress Core
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.
On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.
Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.
CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.
Eye Security published forensic IR tooling for wp2shell (CVE-2026-63030/CVE-2026-60137), the unauthenticated WordPress core RCE chain, after WordPress.org forced auto-updates.
wp2shell chains a REST API batch-endpoint route-confusion bug (CVE-2026-63030) with an SQL injection in WP_Query's author__not_in parameter (CVE-2026-60137), giving unauthenticated attackers rogue admin and code execution on default installs. Adam Kues of Searchlight Cyber discovered the flaw, a public PoC exists on GitHub, and WordPress.org forced automatic updates across an estimated 200M+ sites. Eye Security released a compromise-scanner WordPress plugin and browser extension and notes database artifacts (oEmbed cache rows, changesets) are the primary evidence since the attack is log-blind; fixed versions are 6.8.6, 6.9.5, and 7.0.2.