---
id: CVE-2026-60137
title: >-
  WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does
  not properly sanitise the author__not_in parameter of WP_Query, which could
  allow SQL Injection when a plugin or theme passes untrusted input to the
  parameter.
summary: >-
  WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does
  not properly sanitise the author__not_in parameter of WP_Query, which could
  allow SQL Injection when a plugin or theme passes untrusted input to the
  parameter.
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
vendor: wordpress
product: wordpress
affected:
  - 'wordpress >= 6.8, < 6.8.6'
  - 'wordpress >= 6.9, < 6.9.5'
  - 'wordpress >= 7.0, < 7.0.2'
patched:
  - wordpress 7.0.2
published: '2026-07-17'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T10:35:47.777'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-60137'
references:
  - url: >-
      https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
    label: contact@wpscan.com
  - url: 'https://wordpress.org/news/2026/07/wordpress-7-0-2-release/'
    label: contact@wpscan.com
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
  - cve.org
epss: 0.05323
epssPercentile: 0.92566
kev: true
kevDateAdded: '2026-07-21'
kevDueDate: '2026-08-04'
kevRansomware: false
exploited: true
exploits:
  github: 10
  githubRepos:
    - 'https://github.com/codeb0ssx/Ultimate-wp2shell'
    - 'https://github.com/Colere-Sys/wp2shell-poc'
    - 'https://github.com/h4cd0c/wp2shell'
  metasploit:
    - auxiliary/scanner/http/wordpress_wp2shell_sqli
    - exploit/multi/http/wp_batch_desync_rce
  checkedAt: '2026-10-27T19:05:46.144Z'
exploitAvailable: true
ssvc:
  exploitation: active
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-07-22T03:55:47.898130Z'
ingestedAt: '2026-07-18T21:25:08.011Z'
---

## Overview

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

## Affected

- `wordpress >= 6.8, < 6.8.6`
- `wordpress >= 6.9, < 6.9.5`
- `wordpress >= 7.0, < 7.0.2`

## Remediation

Upgrade past the affected range:

- `wordpress 7.0.2`