MEDIUM

CVE-2026-60137

Wordpress WordPress 2026-07-17 CVSS v3.1

CVSS

5.9

KEV

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Summary dbcve.org

SQL injection vulnerability in WordPress core's WP_Query class where the author__not_in parameter is not properly sanitized. When plugins or themes pass unsanitized user input to this parameter, attackers could inject malicious SQL queries.

Mitigation

Update WordPress to version 6.8.6, 6.9.5, or 7.0.2 or later. Audit custom plugins and themes to ensure they do not pass unsanitized user input to the author__not_in parameter.

Weakness (CWE)

CWE-89 SQL Injection

EPSS Score

78.31%

Probability of exploitation in next 30 days

99.6th percentile

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf Vendor Advisory https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ Release Notes https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE