medium CVSS 5.9 Actively exploited EPSS 5.3%

CVE-2026-60137·WordPress vulnerability

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Severity
medium
Software
WordPress
Fixed in
7.0.2
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 5.3% — in the top 8% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 7.0

Until: 7.0.2

Fixed in: 7.0.2

How to fix this CVE

Update WordPress to version 7.0.2 or later to patch the SQL injection vulnerability in the author__not_in parameter handling. If you are running WordPress 6.8.x or 6.9.x, update to 6.8.6 or 6.9.5 respectively. Review any custom plugins or themes that may be passing unsanitized user input to WP_Query to prevent similar vulnerabilities.

sudo dnf update wordpress

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

POST|GET requests containing 'author__not_in' parameter with SQL metacharacters such as: UNION, SELECT, OR 1=1, CAST, CONVERT, or comment sequences (-- , /* */)

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Block or log requests where the author__not_in parameter contains SQL keywords, logical operators, or comment syntax. Implement strict input validation requiring the parameter to contain only numeric values separated by commas. Example ModSecurity rule: SecRule ARGS:author__not_in '@rx (?i)(union|select|or\s+1|cast|convert|--|/\*)' 'id:1000,phase:2,deny,status:403,msg:SQL Injection Attempt'

How to check if you are affected

  1. Step 1: Check your WordPress version by logging into the admin dashboard (Dashboard > At a Glance) or running: grep 'wp_version' /var/www/html/wp-includes/version.php | head -1
  2. Step 2: Verify if vulnerable versions are running: If output shows version 7.0.0, 7.0.1, 6.8.0-6.8.5, or 6.9.0-6.9.4, your installation is vulnerable
  3. Step 3: Search web server logs for suspicious author__not_in parameter patterns: grep -r 'author__not_in' /var/log/apache2/access.log* /var/log/nginx/access.log*
  4. Step 4: After updating to 7.0.2+, confirm the fix by running the version check again and verifying it now shows 7.0.2 or higher

FAQ

What is CVE-2026-60137?

This vulnerability is a SQL injection flaw in WordPress's WP_Query class where the author__not_in parameter fails to properly sanitize input, allowing attackers to execute arbitrary SQL queries if a plugin or theme passes untrusted data to this parameter without additional validation.

Is CVE-2026-60137 being actively exploited?

Yes, this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild, though no public proof-of-concept exploit has been released.

What versions of WordPress are affected by CVE-2026-60137?

WordPress versions 6.8.0 through 6.8.5, 6.9.0 through 6.9.4, and 7.0.0 through 7.0.1 are affected. Fixed versions are 6.8.6, 6.9.5, and 7.0.2 respectively.

How do I check if my server is vulnerable to CVE-2026-60137?

Run: grep 'wp_version' /var/www/html/wp-includes/version.php to determine your WordPress version, then compare against the affected versions list above.

Does Defensia detect CVE-2026-60137?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If WordPress is installed on a monitored server, CVE-2026-60137 will appear in your dashboard with remediation steps.

Related WordPress CVEs

CVE-2026-63030CVSS 9.8WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137), could allow an attacker to perform SQL Injection and achieve Remote Code Execution.
CVE-2026-87902CVSS 8.1An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-60137. Free for 1 server.

Get started free