CVE-2026-60137
WordPress Core SQL Injection Vulnerability
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Deadline for federal agencies: 2026-08-04.
11 articles across 7 outlets · first covered Jul 18, 2026 · latest Oct 12, 2026
Associated threat actors
Coverage timeline
-
AI Powered Campaign Breaches Ukrainian Infrastructure and 429 WordPress Sitesthehackernews.com · Oct 12, 2026
-
Suspected Chinese Actor Exposed 18,566 Government Records in Campaignsecurityonline.info · Sep 22, 2026
-
CISA adds DDWRT, Langflow and WordPress bugs to KEV listsecurityaffairs.com · Jul 22, 2026
-
CISA warns of active exploits in WordPress, Langflow, DDWRTsecurityonline.info · Jul 21, 2026
-
CISA flags critical WordPress SQLi flaw in KEV, urges patchcisa.gov · Jul 21, 2026
-
Critical WordPress Bug Lets Attackers Run Code Remotelysecurityonline.info · Jul 21, 2026
-
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeoverwww.darkreading.com · Jul 20, 2026
-
AI crafted WordPress exploit chain triggers urgent CVE patcheswww.infosecurity-magazine.com · Jul 20, 2026
-
WordPress flaws CVE-2026-60137 and CVE-2026-63030 allow RCEwww.securityweek.com · Jul 20, 2026
-
Public PoC exploits hit critical WordPress CVEs, urging patchessecurityaffairs.com · Jul 19, 2026
-
WordPress SQLi bug allows remote code execution, update nowsecurityonline.info · Jul 18, 2026