CVE-2026-60137: WordPress Core SQL Injection Vulnerability

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: yes — in CISA KEV since 2026-07-21
EPSS: 5.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-17 · updated 2026-10-08
Weakness: CWE-89

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Affected products

WordPress: from 6.8 before 6.8.6; from 6.9 before 6.9.5; from 7.0 before 7.0.2 — fixed in 6.8.6, 6.9.5, 7.0.2

How to fix

Upgrade to a fixed version: WordPress 6.8.6, 6.9.5, 7.0.2. Check the vendor advisory for mitigations.

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137

Get alerted when CVE-2026-60137 or the next vulnerability affects your stack