CVE-2026-60137 | defend.network

What is CVE-2026-60137?

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

CVSS5.9 NVD 3.1

SeverityMEDIUM

ExploitationNo exploitation reported

EPSS4% · P89

Triage statusNo Known Exploit

ActionSchedule for next cycle

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD published2026-07-17

NVD last modified2026-07-18

Timeline

2026-07-17Published to the U.S. National Vulnerability Database (NVD)
2026-07-18NVD record last updated
2026-07-21First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Apply the latest WordPress security patch immediately
If CVE-2026-60137 is being exploited in a chain with CVE-2026-63030, patch both vulnerabilities before bringing the site back online
Review access logs and web server logs for signs of exploitation or unauthorized access
Reset user credentials for administrative and user accounts post-patch

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 3 of July 2026 (July 20 – 26)
WordPress, SonicWall zero-days in active exploitation; FakeGit malware campaign hits 7,600 GitHub repos (2026-07-21)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.