Search: CVE-2026-60137

WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 contain a vulnerability where the author__not_in parameter in WP_Query is not properly sanitized. This flaw can lead to SQL Injection if untrusted input is passed to this parameter by plugins or themes. The vulnerability has a high severity with a CVSS score of 9.1. Several older Ubuntu package versions of WordPress are also affected.

A suspected Chinese-speaking threat actor linked to Red Heron conducted extensive exploitation campaigns from May to September 2026. The attacker exploited multiple vulnerabilities in WordPress (CVE-2026-63030, CVE-2026-60137) to breach a western government organization, stealing over 18,000 sensitive records including credentials and personally identifiable information. Additionally, the actor exploited CVE-2026-7273 in ZyXEL GS1900 switches, compromising 996 devices across 48 countries and exfiltrating configurations and credentials. The adversary demonstrated sophisticated capabilities such as custom tool development possibly using large language models, privilege escalation, and systematic data exfiltration via PowerShell-based techniques.

Campaign#government breach#kapibalaUnited States+54