- Medium 5.9
- Known exploited (CISA KEV)
CVE-2026-60137
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Scores
The facts
- Published
- 17 July 2026
- Last changed
- 8 October 2026
- NVD status
- Analyzed
- Severity
- Medium, CVSS 5.9 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- Affects
- wordpress wordpress
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 21 July 2026.
- EPSS
- 5.3% chance of exploitation activity in the next 30 days (percentile 93).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.
Scan your domain to see whether this software is visible from the internet. A clear result does not prove you are safe.