What is CVE-2026-60137?

CVE-2026-60137 is a critical-severity vulnerability in Wordpress, classified under SQL Injection. CVSS score: 9.1/10. Published 2026-07-17.

How severe is CVE-2026-60137?

Critical severity. CVSS v3 base score is 9.1 out of 10.

SQL Injection in Wordpress

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Vulnerability class: SQL Injection

CVSS v3 metric

CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Affected products

Wordpress — versions 6.8.0, 6.9.0, 7.0.0

Weakness classification (CWE)

CWE-89 — SQL Injection

References

contact@wpscan.com (technical-description, vdb-entry)
contact@wpscan.com (release-notes, vendor-advisory)

Frequently asked questions

What is CVE-2026-60137?: CVE-2026-60137 is a critical-severity vulnerability in Wordpress, classified under SQL Injection. CVSS score: 9.1/10. Published 2026-07-17.
How severe is CVE-2026-60137?: Critical severity. CVSS v3 base score is 9.1 out of 10.