CVE-2026-60137

MediumCVSS 5.9/10Known exploited (CISA KEV)Last modified Oct 8, 2026

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
WordPress	WordPress	>= 6.8.0, < 6.8.6; >= 6.9.0, < 6.9.5; >= 7.0.0, < 7.0.2

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjfVendor Advisory
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/Release Notes
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137US Government Resource

Timeline

Published: Jul 17, 2026
Last modified: Oct 8, 2026
Added to CISA KEV: Jul 21, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-601388.4Use of out-of-range pointer offset in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Rin CVE-2026-601396.0Improper neutralization in the MigTD SPDM transport for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow CVE-2026-60148.8A flaw has been found in D-Link DIR-513 1.10. This issue affects the function formAdvanceSetup of the file /goform/formAdvanceSetup of the c CVE-2026-601406.1An out-of-bounds read vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption by sending a craf CVE-2026-601414.8Improper null termination for some Intel(R) Metrics Discovery Application Programming Interface before version 1.16.189 within Ring 3: User CVE-2026-601428.4Write-what-where condition in the MigTD for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: Hypervisor may allow an informati CVE-2026-601437.3Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that CVE-2026-601443.6Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that CVE-2026-601454.9Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affect CVE-2026-601466.1Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that CVE-2026-601476.5Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit CVE-2026-601495.2Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that