September 7, 2026

CVE Watchtower


← Back to CVE List

CVE-2026-60137NVD

Vulnerability Summary

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Severity Level
MEDIUM(5.9)
Published Date
Jul 17, 2026
Last Modified
Jul 29, 2026
Exploitation Status
ACTIVE
EPSS Score (30-Day)
78.31%Probability
Root Weakness (CWE)
CWE-89: SQL Injection ↗
Improper neutralization of special elements used in an SQL command, allowing attackers to modify queries.
CVSS v3.1 Base Metrics
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityNone
AvailabilityNone

External References