Security Alert Summary
A SQL injection vulnerability was identified in WordPress core related to the author__not_in parameter of WP_Query. If a theme or plugin passes untrusted input to this parameter, it could allow an attacker to perform SQL injection against the site database.
CVE Details
- CVE ID: CVE-2026-60137
- Affected component: WordPress (core)
- Affected versions: WordPress 6.8.x before 6.8.6; 6.9.x before 6.9.5; 7.0.x before 7.0.2
- Published: July 17, 2026 at 8:17:27 PM UTC
- Last modified: July 18, 2026 at 5:16:54 AM UTC
- CVSS v3.1 (entry 1):
- Base score: 5.9
- Severity: MEDIUM
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack Vector: NETWORK; Attack Complexity: HIGH; Privileges Required: NONE; User Interaction: NONE; Scope: UNCHANGED
- CVSS v3.1 (entry 2):
- Base score: 9.1
- Severity: CRITICAL
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack Vector: NETWORK; Attack Complexity: LOW; Privileges Required: NONE; User Interaction: NONE; Scope: UNCHANGED
- Authentication / Privileges / User interaction: No authentication required; privileges required: NONE; user interaction: NONE (per CVSS data)
- Primary impact:
- Confidentiality: HIGH
- Integrity: NONE or HIGH (two CVSS assessments provided)
- Availability: NONE
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
The vulnerability stems from improper sanitisation of the author__not_in parameter used by WP_Query. When a theme or plugin constructs a query and passes untrusted input into this parameter without appropriate validation or escaping, SQL injection may be possible. The provided data does not name specific functions beyond WP_Query or REST endpoints.
Because the issue is in how input is handled before it reaches the database layer, exploitation could allow an attacker to extract data from the database (confidentiality impact) and, in one assessment, potentially alter data (integrity impact). The exact impact depends on the context in which the vulnerable parameter is used by themes or plugins.
How This Could Impact Your Website
Consider a site managed by a site owner with internal staff and an external contractor who installs or updates themes and plugins. If a contractor or plugin introduces code that forwards unvalidated values into author__not_in, an attacker on the network could craft requests that trigger SQL injection and retrieve sensitive data from the database. Realistic consequences include exposure of internal user email addresses and other stored data, which increases the risk of targeted phishing or social engineering against site staff and contributors.
Even when the vulnerability is in core, the practical risk often depends on installed themes and plugins that use the affected parameter. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update WordPress core to a non-affected release as provided by official WordPress updates.
- Audit installed themes and plugins for code that passes user-controlled data to
WP_Queryparameters such asauthor__not_inwithout proper validation or escaping. - Review and reduce unnecessary user roles, especially contributor-level access for external users.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual database queries or unexpected behavior.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
