CVE-2026-60137

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

CVSS 5.9 medium · WordPress WordPress · published 2026-07-17

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

NVD · CVE.org

Coverage 2 sources

1. 2026-07-18 Help Net Security high Two new high severity WordPress vulnerabilities, patch immediately!

   WordPress 6.9 is vulnerable to two high-severity security issues, including a critical SQL injection issue.

2. 2026-07-21 CISA Cybersecurity Advisories high CISA Adds Four Known Exploited Vulnerabilities to Catalog

   CISA added four new vulnerabilities to its Known Exploited Vulnerabilities Catalog, citing evidence of active exploitation.

Mentioned with

CVE-2021-27137 CVE-2026-0770 CVE-2026-63030

Also covered

• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 1 article · 2026-09-29
• CVE-2023-6548 Cloud Software Group NetScaler ADC CVSS 5.5 · 1 article · 2026-09-28
• CVE-2023-25608 Fortinet FortiAP-W2 CVSS 5.2 · 1 article · 2026-09-28
• CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVSS 9.5 · 3 articles · 2026-09-28
• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 3 articles · 2026-09-28