UpHeron
All vulnerabilities

WordPress core

CVE-2026-60137

Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query`

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 21 Jul 2026.

Severity
Medium 5.9
Published
17 Jul 2026
Last changed
8 Oct 2026
Added to UpHeron
17 Oct 2026
Fixed in
6.8.6, 6.9.5, 7.0.2
Also known as
GHSA-fpp7-x2x2-2mjf
Sources
NVD, WordPress

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • From 6.8.0 before 6.8.6
  • From 6.9.0 before 6.9.5
  • From 7.0.0 before 7.0.2

Known exploited

CISA name
WordPress Core SQL Injection Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
4 Aug 2026
Used in ransomware
Not known

References