CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-07-17
WordPress WP_Query 'author__not_in' Parameter SQL Injection Vulnerability (CVE-2026-60137)
[Affected Scope] WordPress core versions 6.8.x (before 6.8.6), 6.9.x (before 6.9.5), and 7.0.x (before 7.0.2)
[Impact] Successful exploitation allows remote attackers to execute arbitrary SQL commands and retrieve sensitive database information when a plugin or theme passes untrusted input to the 'author__not_in' parameter of WP_Query.
[Mitigation] Immediately upgrade WordPress core to the patched versions (6.8.6, 6.9.5, or 7.0.2) and apply WAF filtering rules.