CVE-2026-60137
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
5.9
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
78.3%
99.6th percentile
CISA KEV
Listed
Added 2026-07-21 · patch by 2026-08-04
Weakness / dates
CWE-89
Published 2026-07-17 · modified 2026-07-29
Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.