Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-60137

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:192584caae6773fe37dd3f66ce505e48fdf4cdc41ae247ea0c483e756b119814
Known exploited
CISA KEV
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 2 assertions

{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/adp/0/metrics/0/cvssV3_1

{"metric":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/metrics/0/cvssV3_1
cwe · 2 assertions

{"description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/problemTypes/0/descriptions/0

{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/adp/0/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"defaultStatus":"unaffected","product":"WordPress","vendor":"WordPress","versions":[{"lessThan":"6.8.6","status":"affected","version":"6.8.0","versionType":"semver"},{"lessThan":"6.9.5","status":"affected","version":"6.9.0","versionType":"semver"},{"lessThan":"7.0.2","status":"affected","version":"7.0.0","versionType":"semver"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/affected/0

Provider-owned CVSS observations

2 source assertions
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/adp/0/metrics/0/cvssV3_1
{"metric":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/problemTypes/0/descriptions/0
{"cweId":"CWE-89","description":"CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/adp/0/problemTypes/0/descriptions/0

Known exploitation assertions

2 source assertions
{"cwes":["CWE-89"],"dateAdded":"2026-07-21","dueDate":"2026-08-04","knownRansomwareCampaignUse":"Unknown","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137","product":"Core","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance w…
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:4beaa57afdb0d729c5c3f099dc629a4f050c7de39092180911b79a75e0c68cbc · sha256:635dff916c4092c0… · /vulnerabilities/9
    Open source location →
{"cwes":["CWE-89"],"dateAdded":"2026-07-21","dueDate":"2026-08-04","knownRansomwareCampaignUse":"Unknown","notes":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-60137","product":"Core","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance w…
  • cisa_kev_jsonknown_exploited
    urn:baitaphish:normalized-source-record:v2:aa0147f1a516c2c00cee47949f3582451c8e4f9e2b6a711fe387997256ad5339 · sha256:16acee8334e59e44… · /vulnerabilities/6
    Open source location →

Source references

3 source assertions
{"tags":["vdb-entry","technical-description"],"url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/references/0
{"tags":["release-notes","vendor-advisory"],"url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/cna/references/1
{"tags":["government-resource"],"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:13af3cb81c8e55b8a743fc5649e42f3eed5f838f6f9b8c02ef69f25aed128d2d · sha256:27d4b163e2e6cd6d… · /containers/adp/0/references/0

Attribution and limitations

  • CISA Known Exploited Vulnerabilities JSON: CISA named for provenance; do not use CISA/DHS marks or imply endorsement Source →
  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer