Executive brief
WordPress, the software used to power millions of websites, contains a critical security flaw in its core database query system. This vulnerability allows attackers to manipulate database commands, potentially leading to the theft of sensitive user data or full site takeover. When combined with other known issues, it can allow an unauthorized person to take complete control of a website without needing any login credentials.
Technical details
A SQL injection vulnerability exists in WordPress Core due to improper sanitization of the 'author__not_in' parameter within the WP_Query class. The flaw is triggered when a plugin or theme passes untrusted user input directly into this parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands against the underlying database. Furthermore, this vulnerability can be chained with CVE-2026-63030 to achieve remote code execution (RCE) on default installations. Patches are available in versions 6.8.6, 6.9.5, and 7.0.2.
Affected products
- WordPress WordPress Core 6.8.x before 6.8.6, 6.9.x before 6.9.5, 7.0.x before 7.0.2
Timeline
- 2026-07-17: advisory: Initial advisory published by WPScan and CISA-ADP
- 2026-07-21: disclosed: NVD publication date
- 2026-07-21: exploited: Reported as exploited in the wild in advisory summary