CVE-2026-60137 WordPress Core SQL Injection
Attackers can execute SQL injection via the author__not_in parameter in WP_Query if plugins or themes pass untrusted input, requiring an upgrade to WordPress.
- Exploited in the wild
- Since 21 Jul 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-60137?
CVE-2026-60137 is a medium-severity SQL injection vulnerability in Wordpress Wordpress, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Weakness: CWE-89
Which versions are affected by CVE-2026-60137?
2 open source packages ship an affected version, including wordpress and wordpress-multisite. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
wordpress Bitnami | From 6.8.0 | 6.8.6, 6.9.5, 7.0.2 |
wordpress-multisite Bitnami | From 6.8.0 | 6.8.6, 6.9.5, 7.0.2 |
Products include Wordpress Wordpress.
How do I fix CVE-2026-60137?
Upgrade wordpress to a fixed version for your release line: 6.8.6, 6.9.5 or 7.0.2. US federal agencies must fix it by 4 Aug 2026.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-60137 being exploited?
Yes. Attackers have exploited CVE-2026-60137 in the wild since at least 21 Jul 2026.
Public exploit code: 2 Metasploit modules and 10 proofs of concept on GitHub.
Other vulnerabilities in Wordpress Wordpress
Sources
Also known as BIT-wordpress-2026-60137, BIT-wordpress-multisite-2026-60137, DEBIAN-CVE-2026-60137, MINI-cvxg-6j2r-774h, MINI-gp5r-m5x6-3h6g, UBUNTU-CVE-2026-60137.