CVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a

CSIRTS triage

What

WordPress versions before 6.8.6, 6.9.5, and 7.0.2 do not properly sanitize input, allowing SQL injection.

Who is affected

Users of WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 are affected.

Urgency

Remediation is important due to the potential for SQL injection attacks.

Action

Update WordPress to the latest version.

AI-assisted analysis generated from the source advisory — verify against the original.

Details

Source

NVD Recent CVEs (US · database · site)

Severity

medium — CVSS 5.9

Published

2026-07-17

Last updated

2026-07-22

Exploitation

Observed in the wild (CISA KEV)

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-60137

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

• Exploitation confirmedCVE-2026-60137Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.

Referenced CVEs

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

• critical[NEW] [critical] WordPress: Multiple vulnerabilities allow code executioncert-bund
• unknownDSA-6399-1 wordpress - security updatedebian
• unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
• highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
• criticalexploitedCVE-2026-60137: WordPress Core SQL Injection Vulnerabilitycisa-kev
• unknownWordPress Multiple Vulnerabilitieshkcert
• unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
• unknownMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-avis
• unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl

Recent advisories for WordPress

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

• mediumCVE-2026-6453: The CubeWP Framework plugin for WordPress is vulnerable to SQL Injection in all versions up to …nvd · 2026-08-01
• mediumCVE-2026-18435: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
• mediumCVE-2026-18344: The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site …nvd · 2026-08-01
• mediumCVE-2026-18062: The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnera…nvd · 2026-08-01
• mediumCVE-2026-18059: The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to…nvd · 2026-08-01
• mediumCVE-2026-17605: The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vul…nvd · 2026-08-01

More from NVD Recent CVEs

• mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
• mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
• mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
• highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
• mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01