WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which… (CVE-2026-60137)

CVE-2026-60137 describes a SQL Injection vulnerability in WordPress where the author__not_in parameter of WP_Query is not properly sanitized. This can lead to an attacker injecting SQL commands if untrusted input is passed by plugins or themes. The vulnerability affects WordPress 6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, and 7.0.x prior to 7.0.2, as well as various Ubuntu-packaged versions. The CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating network exploitable with low attack complexity, no privileges or user interaction required, and high impact on confidentiality and integrity.

Successful exploitation could allow an attacker to perform SQL Injection attacks, potentially leading to unauthorized data access or modification. The vulnerability impacts confidentiality and integrity but not availability. No known exploits in the wild have been reported.

Fixes are available in WordPress versions 6.8.6, 6.9.5, and 7.0.2. Users should upgrade to these or later versions to remediate the vulnerability. Since this is not a cloud service, administrators must apply these updates manually. No vendor advisory content was provided to indicate otherwise.