CVE-2026-60137 Overview
CVE-2026-60137 is a SQL Injection vulnerability in WordPress core affecting the WP_Query class. The flaw resides in the handling of the author__not_in parameter, which is not properly sanitised before being incorporated into database queries. When a plugin or theme passes untrusted input to this parameter, an attacker can inject arbitrary SQL and read sensitive data from the WordPress database.
The vulnerability affects WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. CISA has added the issue to the Known Exploited Vulnerabilities catalog, confirming active exploitation.
Critical Impact
Attackers exploiting untrusted author__not_in input can extract confidential database contents, including user credentials and session tokens, from vulnerable WordPress installations.
Affected Products
- WordPress 6.8.x prior to 6.8.6
- WordPress 6.9.x prior to 6.9.5
- WordPress 7.0.x prior to 7.0.2
Discovery Timeline
- 2026-07-17 - CVE-2026-60137 published to NVD
- 2026-07-22 - Last updated in NVD database
Technical Details for CVE-2026-60137
Vulnerability Analysis
The defect is a classic SQL Injection [CWE-89] in the WordPress core query builder. WP_Query accepts an author__not_in argument that is intended to exclude posts authored by specific user IDs. Vulnerable versions fail to cast or sanitise the values in this array before appending them to the generated SQL statement.
When a plugin or theme forwards HTTP request data directly into WP_Query arguments, an attacker controlled string reaches the database engine. The attacker can then break out of the intended NOT IN (...) clause and append arbitrary SQL fragments, including UNION SELECT statements against the wp_users and wp_usermeta tables.
Exploitation requires that a plugin or theme installed on the target site expose the author__not_in parameter to unauthenticated or low-privileged input, which explains the high attack complexity in the CVSS vector. The EPSS score of 77.97% (99.5th percentile) reflects broad attacker interest given the WordPress install base.
Root Cause
The root cause is missing type enforcement in the author__not_in handling path inside WP_Query. Values that should be integers are concatenated into SQL without being cast through absint() or prepared through $wpdb->prepare(). Downstream code assumes callers validate the input, but many plugins and themes forward query variables directly from $_GET or $_POST.
Attack Vector
The attack vector is network based and requires no authentication when a vulnerable plugin or theme exposes the parameter through a public endpoint. An attacker crafts an HTTP request containing a payload in a query parameter that the plugin passes to WP_Query as author__not_in. The injected SQL executes with the privileges of the WordPress database user, allowing exfiltration of arbitrary table contents.
A sanitised example of the vulnerable request pattern involves supplying an author__not_in element such as 1) UNION SELECT user_login,user_pass FROM wp_users-- - instead of a numeric user ID. Refer to the WordPress GitHub Security Advisory GHSA-fpp7-x2x2-2mjf for the authoritative technical writeup.
Detection Methods for CVE-2026-60137
Indicators of Compromise
- Web server access logs containing SQL keywords such as UNION, SELECT, SLEEP(, or INFORMATION_SCHEMA in parameters that map to author__not_in.
- Unexpected outbound database errors or 500 responses tied to requests carrying author__not_in[] parameters.
- New or modified administrator accounts in wp_users that do not correlate with legitimate admin activity.
- Anomalous read spikes against wp_users and wp_usermeta from the WordPress application user.
Detection Strategies
- Deploy Web Application Firewall (WAF) signatures that inspect any query variable named author__not_in and reject values that are not strictly numeric.
- Enable MySQL general query logging or slow query logging temporarily to identify NOT IN clauses containing non-integer literals.
- Correlate WordPress debug.log errors of type WordPress database error with the originating HTTP request in reverse proxy logs.
Monitoring Recommendations
- Track WordPress core version across all managed sites and alert on any install still running 6.8.x < 6.8.6, 6.9.x < 6.9.5, or 7.0.x < 7.0.2.
- Monitor for privilege escalation events such as changes to wp_capabilities values in wp_usermeta.
- Review CISA KEV updates and threat intelligence feeds for exploitation reports referencing CVE-2026-60137.
How to Mitigate CVE-2026-60137
Immediate Actions Required
- Update WordPress core to 6.8.6, 6.9.5, or 7.0.2 depending on the branch in use.
- Audit installed plugins and themes for direct use of author__not_in with untrusted input and apply absint() or array_map('intval', ...) before passing values.
- Rotate all WordPress administrator passwords and secret keys defined in wp-config.php if exploitation is suspected.
- Review wp_users for unauthorised accounts and remove any that cannot be attributed to legitimate provisioning.
Patch Information
The WordPress security team addressed the flaw by enforcing integer casting on entries in author__not_in inside WP_Query. Fixed releases are 6.8.6, 6.9.5, and 7.0.2. See the WordPress 7.0.2 release announcement and the GitHub Security Advisory for patch details. Automatic background updates deliver the fix on sites where minor updates are enabled.
Workarounds
- Configure a WAF rule to drop requests where author__not_in or any array member is non-numeric.
- Disable or remove plugins and themes that forward raw request variables into WP_Query until patched.
- Restrict the database user assigned to WordPress to the minimum required privileges to limit the impact of injection.
# Configuration example: WP-CLI upgrade to a fixed release
wp core update --version=7.0.2 --force
wp core update-db
wp plugin list --update=available --format=csv
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
