CVE-2026-60137

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

State: Published
Severity: 5.9 Medium
Published: Jul 17, 2026
Updated: Oct 7, 2026
Reserved: Jul 17, 2026

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Scores

CVSS	Score	Vector	Source
3.1	5.9 Medium	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	WPScan

Weaknesses

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected Products

Product	Versions
WordPressWordPress	6.8.0 to before 6.8.6Affected 6.9.0 to before 6.9.5Affected 7.0.0 to before 7.0.2Affected

References

https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjfvdb-entrytechnical-description
https://wordpress.org/news/2026/07/wordpress-7-0-2-release/release-notesvendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.