WordPress WP_Query 'author__not_in' Parameter SQL Injection Vulnerability (CVE-2026-60137)

1. Upgrade WordPress Core

Apply the official security updates immediately.

• WordPress 7.0.x: Upgrade to 7.0.2 or higher
• WordPress 6.9.x: Upgrade to 6.9.5 or higher
• WordPress 6.8.x: Upgrade to 6.8.6 or higher

Using WP-CLI, you can update your installation with the following command:

wp core update --version=7.0.2

2. Temporary Mitigation (WAF Rule)

If immediate patching is not possible, deploy a Web Application Firewall (WAF) rule to block non-numeric values in the author__not_in parameter.

ModSecurity Rule Example:

SecRule ARGS:author__not_in "[^0-9,]" \
    "id:1000001,\
    phase:2,\
    deny,\
    status:400,\
    log,\
    msg:'CVE-2026-60137: SQLi Attempt in author__not_in parameter'"

3. Developer Remediation (Plugins & Themes)

Ensure all inputs passed to WP_Query parameters are strictly sanitized and type-cast to integers.

// Vulnerable Implementation
$args = [
    'author__not_in' => $_GET['exclude_authors']
];
$query = new WP_Query($args);

// Secure Implementation
$exclude_authors = isset($_GET['exclude_authors']) ? array_map('intval', (array)$_GET['exclude_authors']) :;
$args = [
    'author__not_in' => $exclude_authors
];
$query = new WP_Query($args);

This vulnerability (CVE-2026-60137) exists in the WP_Query class of WordPress core due to insufficient sanitization and type-casting of the author__not_in parameter.

While WordPress core does not directly expose this parameter to untrusted user input, many third-party plugins and themes pass raw HTTP request parameters (e.g., from $_GET or $_POST) directly into WP_Query arguments. An attacker can exploit this behavior by injecting malicious SQL payloads into the parameter, leading to SQL Injection (SQLi). This can be leveraged to extract sensitive data from the database, including user password hashes and session tokens.

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and has an EPSS score of 0.94, indicating active exploitation in the wild and requiring immediate remediation.