Skip to content
CVE PROGRAM SOURCE RECORD5.9 Medium

CVE-2026-60137

WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

WordPress WordPress

Default version status: unaffected

  • 6.8.0 to < 6.8.6affected
  • 6.9.0 to < 6.9.5affected
  • 7.0.0 to < 7.0.2affected

References