CVE-2026-60137KEV · OVERDUECWE-89sql-injection

WordPress Core SQL Injection Vulnerability

Medium · published July 18, 2026

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.9. It is confirmed in active exploitation. It sits in the 92.6th percentile for exploit probability.

81
days past CISA
deadline
CVSS v3.1
5.9
EPSS
5%
Percentile
92.6
In the wild
Confirmed
Chains
1
What it is

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Part of a larger chain

CVE-2026-63030's CNA description states the REST API batch endpoint route confusion is exploitable "combined with the author__not_in WP_Query SQL Injection (CVE-2026-60137)".

CVE-2026-60137SQL injection · 5.9
CVE-2026-63030Interpretation conflict · 9.8
Remote code executionFull site compromise
The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.05323 · 92.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-07-18T00:17Z
KEV added
2026-07-21 · due 2026-08-04
Affected products (3)
ProductVersionsFixed in
wordpress/wordpress≥ 6.8, < 6.8.66.8.6
wordpress/wordpress≥ 6.9, < 6.9.56.9.5
wordpress/wordpress≥ 7.0, < 7.0.27.0.2
References (3)
https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf · [email protected]https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ · [email protected]https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 25 SEP 03:26Z
    EPSS moved 78% → 6%
    epss
  • 21 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 4
    kev
  • 17 JUL 19:14Z
    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
    cvelistv5