CVE-2026-60137
WordPress Core SQL Injection Vulnerability
Description
CVE-2026-60137 is a SQL injection vulnerability in WordPress core: the author__not_in parameter of WP_Query is not properly sanitised, so any plugin or theme that passes untrusted input into that parameter hands an attacker control over part of the resulting SQL statement. WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 are affected, which means the flaw sits in the query layer that essentially every WordPress site relies on rather than in one optional component. The CVSS score of 5.9 (Medium) reflects the dependency on a plugin or theme forwarding the untrusted value, but the EPSS score of 79% puts CVE-2026-60137 in the 99.6th percentile for exploitation likelihood, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation due date of 2026-08-04. The vulnerability also serves as the injection primitive in a chain with CVE-2026-63030, a REST API route confusion issue that turns this SQL injection into remote code execution.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| wordpress | wordpress | >= 6.8, < 6.8.6; >= 6.9, < 6.9.5; >= 7.0, < 7.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
References
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
SQL Injection occurs when software builds all or part of an SQL command from externally influenced input without neutralising the special elements that can change the meaning of the query. In WordPress the author__not_in argument of WP_Query is intended to receive a list of author IDs and is interpolated into the query's WHERE clause, but because the values are not properly sanitised, a plugin or theme that passes user-controlled data into that argument allows attacker-supplied SQL fragments to reach the database, exposing the contents of the WordPress tables.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Impact Analysis
CVE-2026-60137 has a CVSS 3.1 base score of 5.9 (Medium): it is remotely exploitable without physical access, needs no authentication, and requires no user action, but attack complexity is rated high because exploitation depends on a plugin or theme actually routing untrusted input into author__not_in. Confidentiality (High): where that condition is met, an attacker can read arbitrary data from the WordPress database, including the wp_users table with usernames and password hashes, private post content, and options rows that often hold API keys and integration secrets. Integrity and Availability (None): this particular parameter yields a read-oriented injection rather than a path to writing or destroying data on its own. The important caveat is that the plugin ecosystem is large and WP_Query arguments are commonly passed straight through from request parameters, so the practical hit rate is far higher than a 5.9 rating suggests — reflected in the EPSS score of 79%, which signals a high likelihood of active exploitation. Chained with the route confusion issue CVE-2026-63030, the same defect contributes to a critical unauthenticated remote code execution path against the site.
Exploit Maturity
CVE-2026-60137 is listed in CISA's Known Exploited Vulnerabilities catalog, so active exploitation in the wild is confirmed, with a deadline of 2026-08-04; ransomware use is currently marked as Unknown. No public exploit code is linked in the available references — the sources are the WordPress security advisory GHSA-fpp7-x2x2-2mjf, the WordPress 7.0.2 release notes, and the CISA KEV entry — but the EPSS score of 79% (99.6th percentile) indicates near-certain ongoing exploitation activity, which is what one expects for a core-level flaw in the most widely deployed CMS. The chaining potential is the decisive factor: NVD's description of CVE-2026-63030 states that the REST API batch endpoint route confusion issue, combined with this author__not_in SQL injection, could allow an attacker to perform SQL injection and achieve remote code execution. Treated in isolation this is a Medium data-disclosure bug; treated as one half of a published chain it is part of a critical unauthenticated compromise path, so update core immediately.
Remediation
- Follow the CISA KEV required action: apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 risk-based patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable. The KEV due date is 2026-08-04.
- Update WordPress core to 6.8.6, 6.9.5, or 7.0.2, the releases that fix the sanitisation of
author__not_in, as described in GHSA-fpp7-x2x2-2mjf and the WordPress 7.0.2 release announcement. Sites that rely on automatic minor updates should confirm the resulting version rather than assume the update applied. - Audit installed plugins and themes for code that passes request data into
WP_Queryarguments, especiallyauthor__not_in,author__in, and related list parameters, and cast such values to integers before use. This removes the exploitable path even where an unpatched core remains in place temporarily. - Review database and web server logs for queries or requests containing SQL syntax in author-related parameters, check
wp_usersfor unexpected administrator accounts, and rotate credentials and API keys stored in the options table if any evidence of extraction is found — exploitation is confirmed in the wild, so log review is not optional. - As long-term hardening against SQL injection (CWE-89), use
$wpdb->prepare()for every custom query, never interpolate request data into SQL strings, apply allowlist validation and integer casting at the entry point, and give the database user only the privileges the site actually needs so that a future injection has a smaller blast radius.
Technical Details
The defect behind CVE-2026-60137 is missing sanitisation of the author__not_in argument in WP_Query, the core class that translates query arguments into SQL for nearly all WordPress content retrieval. author__not_in is documented to accept a list of author IDs that are excluded from results, and those values are placed into the generated WHERE clause; because they are not properly neutralised, a caller that forwards untrusted input allows special elements to alter the intended SQL command (CWE-89). The vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N shows an unauthenticated network attack with no user interaction, where the AC:H metric encodes the environmental precondition that a plugin or theme must supply the untrusted value — WordPress core itself does not expose the parameter to unfiltered request data. Only confidentiality is impacted, at High, because the injection point sits in a selection clause and yields data disclosure from the WordPress schema. The affected ranges are 6.8 up to but not including 6.8.6, 6.9 up to but not including 6.9.5, and 7.0 up to but not including 7.0.2.
Frequently Asked Questions
Is CVE-2026-60137 being actively exploited?
Yes. CVE-2026-60137 is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of 2026-08-04, and its EPSS score of 79% places it in the 99.6th percentile, indicating near-certain exploitation activity. Ransomware usage is currently marked as Unknown, but the vulnerability is documented as part of a chain with CVE-2026-63030 that leads to remote code execution.
What products are affected by CVE-2026-60137?
The vulnerability affects WordPress core in versions 6.8 up to but not including 6.8.6, 6.9 up to but not including 6.9.5, and 7.0 up to but not including 7.0.2. Exploitation additionally requires a plugin or theme that passes untrusted input into the author__not_in parameter of WP_Query, so sites with a large plugin footprint carry the greater risk.
How do I fix CVE-2026-60137?
Update WordPress core to 6.8.6, 6.9.5, or 7.0.2, which fix the sanitisation of author__not_in. Additionally audit plugins and themes for code that forwards request data into WP_Query arguments and cast those values to integers, then review logs and the wp_users table for evidence of prior data extraction.
How severe is CVE-2026-60137?
The CVSS 3.1 base score is 5.9 (Medium), because the high attack complexity reflects the need for a plugin or theme to pass untrusted input into the vulnerable parameter, with a high impact on confidentiality only. The EPSS score of 79% sits in the 99.6th percentile, however, and because the flaw acts as the SQL injection primitive in the CVE-2026-63030 chain that achieves remote code execution, its real-world severity is considerably higher than the base score alone.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.