CVE-2026-60137
Act now ● On CISA KEV — actively exploited
Actively exploited — on the CISA KEV list.
CVSS base
5.9
MEDIUM
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS — probability of exploitation (30 days)
78.3%
99.6th percentile
CISA KEV
Listed
Added 2026-07-21 · patch by 2026-08-04
Weakness / dates
CWE-89
Published 2026-07-17 · modified 2026-07-29
CVSS breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
| Attack Vector | N | Network |
| Attack Complexity | H | High |
| Privileges Required | N | None |
| User Interaction | N | None |
| Scope | U | Unchanged |
| Confidentiality | H | High |
| Integrity | N | None |
| Availability | N | None |
Timeline
- 2026-07-17 — Published (NVD)
- 2026-07-21 — Added to CISA KEV (actively exploited)
- 2026-08-04 — CISA patch-by deadline
- 2026-07-29 — Last modified (NVD)
Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.