{"id":"CVE-2026-60137","aliases":["BIT-wordpress-multisite-2026-60137"],"url":"https://o3.security/vulnerability/CVE-2026-60137","summary":"WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query","details":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.","published":"2026-07-27T05:55:53.343Z","modified":"2026-10-08T09:15:02.722180481Z","cvss":null,"epss":{"score":0.78305,"percentile":0.99557,"asOf":"2026-09-17"},"cisaKev":{"dateAdded":"2026-07-21","dueDate":"2026-08-04","knownRansomwareCampaignUse":false},"exploitsKnown":2,"affectedPackages":[{"ecosystem":"Bitnami","name":"wordpress","fixedVersion":"6.8.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf"},{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-60137"},{"type":"ARTICLE","url":"https://wordpress.org/news/2026/07/wordpress-7-0-2-release/"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"}],"provenance":{"sources":["OSV.dev","CISA KEV","FIRST.org (EPSS)"],"lastVerified":"2026-10-08T09:15:02.722180481Z"}}