# CVE-2026-60137: WordPress SQL injection in WP_Query author__not_in parameter

Source: https://junglewise.ai/threats/cve-2026-60137-wordpress-sql-injection-in-wp-query-author-not-in-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-60137 · Severity: critical · CVSS 9.1 · Exploited in the wild · Published 2026-07-17

WordPress, the software used to power millions of websites, contains a critical security flaw in its core database query system. This vulnerability allows attackers to manipulate database commands, potentially leading to the theft of sensitive user data or full site takeover. When combined with other known issues, it can allow an unauthorized person to take complete control of a website without needing any login credentials.

Technologies: [Wordpress](https://junglewise.ai/threats/technologies/wordpress). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2026-60137 exploited in the wild?** Yes. CVE-2026-60137 is known to be exploited in the wild, first recorded on 21 July 2026. Treat it as urgent.

**How severe is CVE-2026-60137?** Critical severity, with a CVSS score of 9.1, published 17 July 2026.

**Which products and versions are affected?** Wordpress 6.8.0 - 6.8.5, 6.9.0 - 6.9.4, 7.0.0 - 7.0.1; WordPress Core 6.8.x before 6.8.6, 6.9.x before 6.9.5, 7.0.x before 7.0.2.

**Is there a fix for CVE-2026-60137?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-60137 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-60137?** Check whether you run Wordpress or WordPress Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in WordPress Core due to improper sanitization of the 'author__not_in' parameter within the WP_Query class. The flaw is triggered when a plugin or theme passes untrusted user input directly into this parameter. An unauthenticated remote attacker can exploit this to execute arbitrary SQL commands against the underlying database. Furthermore, this vulnerability can be chained with CVE-2026-63030 to achieve remote code execution (RCE) on default installations. Patches are available in versions 6.8.6, 6.9.5, and 7.0.2.

## Affected products

- WordPress WordPress Core 6.8.x before 6.8.6, 6.9.x before 6.9.5, 7.0.x before 7.0.2

## Timeline

- 2026-07-17: advisory: Initial advisory published by WPScan and CISA-ADP
- 2026-07-21: disclosed: NVD publication date
- 2026-07-21: exploited: Reported as exploited in the wild in advisory summary

## Related threats

- [WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in)
- [WordPress Core stored cross-site scripting in Quick Edit](https://junglewise.ai/threats/cve-2026-114570-wordpress-core-is-vulnerable-to-stored-cross-site-scripting-via)
- [WordPress Core remote file inclusion](https://junglewise.ai/threats/cve-2026-87902-wordpress-core-remote-file-inclusion)
- [WordPress REST API route confusion and SQL injection leading to RCE](https://junglewise.ai/threats/cve-2026-63030-wordpress-rest-api-route-confusion-and-sql-injection-leading-to)
- [MediaElement.js Reflected XSS in FlashMediaElement component](https://junglewise.ai/threats/cve-2016-4567-mediaelement-js-reflected-xss-in-flashmediaelement-component)