CVE-2026-60137: WordPress Core SQL Injection Vulnerability
Vulnerability summary
CVE-2026-60137 is a high (CVSS 7.5) vulnerability in WordPress Core. It is known to be exploited: CISA and ENISA list it, first on 21-07-2026. EPSS estimates a 5.32% chance of exploitation in the next 30 days, higher than 92.6% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 6.8.6.
Listed as exploited by ENISA (21-09-2026)
Source freshness unavailable
How is this decided?Timeline
- 17-07-2026PublishedVulnerability first disclosed.
- 21-07-2026Added to CISA KEVExploitedWordPress Core SQL Injection Vulnerability
- 04-08-2026CISA remediation dueDeadline passedApply mitigations per vendor instructions.
- 21-09-2026Added to ENISA KEVExploitedAdded to the ENISA known exploited vulnerabilities catalog.
- 07-10-2026Last modifiedVulnerability information updated.
Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVSS metrics
5 scores · 5 sources · 1 version- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
5.32%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
Decrease -0.58 pp
From 5.91% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 21-07-2026
- Federal due date
- 04-08-2026
ENISA CNWListed- Added
- 21-09-2026
CIRCLNot in the CIRCL catalog.
CISA required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. wordpress.org/news/2026/07/wordpress-7-0-2-release/ nvd.nist.gov/vuln/detail/CVE-2026-60137
Public exploits
2 foundWordPress Core wp2shell Unauthenticated SQL Injection via REST Batch Route Confusion
auxiliary/scanner/http/wordpress_wp2shell_sqli
Maturity: poc
WordPress WP2Shell REST API Batch Route Confusion SQLi to RCE
exploit/multi/http/wp_batch_desync_rce
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Wordpress2 products
- wordpress≥ 6.8, < 6.8.5 (fixed in 6.8.6) | ≥ 6.9, < 6.9.5 (fixed in 6.8.6) | ≥ 7.0, < 7.0.2 (fixed in 6.8.6)
- wordpress≥ 6.8.0, < 6.8.6 | ≥ 6.9.0, < 6.9.5 | ≥ 7.0.0, < 7.0.2 | ≥ 6.8, < 6.8.6 | ≥ 6.9, < 6.9.5 | ≥ 7.0, < 7.0.2
Debian1 product
- wordpress< 6.8.6+dfsg1-0+deb13u1 | < 7.0.2+dfsg1-1
Ubuntu1 product
- wordpressAll versions (No fix recorded)
3 vendors · 4 products
References
11 links- github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjfVDB EntryTechnical DescriptionREPORTVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137Government ResourceUS Government Resource
