CVE-2026-60137

CWE-89

High

77.3

RPS

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Source: NVD

CVSS: 5.9; Medium · v3.1
EPSS: 5.90%; Probability of exploitation in the next 30 days (FIRST)
CISA KEV: In CISA KEV since Jul 2026
Fix commit: No known fix commit; Sources: MoreFixes, FreshFixes
Weakness: CWE-89
Published: 17 Jul 2026; Last modified 29 Jul 2026

How to read these signals: RPS · EPSS · CISA KEV · Data sources

Get this score from the API

curl -H "Authorization: Bearer dsec_live_xxxxxxxx" \
  https://api.intelligence.devsecure.io/api/v1/rps/CVE-2026-60137

Replace the placeholder with your key. Get a free API key or rank your own CVEs.

Data as of 7 Oct 2026, 05:16 UK time

CVE-2026-60137

Description

Signals

Get this score from the API