CVE-2026-60137: SQL injection in WordPress

Affected and fixed versions
Component	Affected	Fixed in
WordPress (core)	6.8 up to (not including) 6.8.6, 6.9 up to (not including) 6.9.5, 7.0 up to (not including) 7.0.2	6.8.6, 6.9.5, 7.0.2

Summary

What it is: A generic SQL Injection vulnerability in WordPress Core via the author__not_in parameter.
Who it affects: WordPress Core versions 6.8 through 7.0.1.
Is it patched: Yes, patched versions 6.8.6, 6.9.5, and 7.0.2 were released on July 17, 2026.
Is it being exploited: Yes, public exploitation tools are available, and active attacks have been observed.

Affected and patched versions

WordPress (core wordpress): affected 6.8 up to (not including) 6.8.6, 6.9 up to (not including) 6.9.5, 7.0 up to (not including) 7.0.2; fixed in 6.8.6, 6.9.5, 7.0.2

Is my site vulnerable?

To determine if a WordPress site is vulnerable to CVE-2026-60137, administrators should check the installed version of WordPress Core. This vulnerability affects WordPress Core versions 6.8 through 7.0.1. Specifically, any site running WordPress version 6.8 up to, but not including, 6.8.6 is vulnerable. Similarly, sites running version 6.9 up to, but not including, 6.9.5 are affected. Additionally, WordPress installations from version 7.0 up to, but not including, 7.0.2 are also vulnerable.

To check the WordPress version, log into the WordPress administration dashboard and navigate to the 'At a Glance' section on the main dashboard page. Alternatively, the version information can be found in the version.php file located in the wp-includes directory of the WordPress installation. If the installed version falls within these specified ranges, the site is exposed to this SQL injection vulnerability.

What an attacker actually does

CVE-2026-60137 describes a generic SQL Injection vulnerability within WordPress Core. This flaw specifically targets the author__not_in parameter, which is used by WP_Query to filter posts based on authors. The core issue arises from insufficient escaping of user-supplied input provided to this parameter and an inadequate preparation of the existing SQL query that processes this input.

An unauthenticated attacker can exploit this weakness by manipulating the author__not_in parameter. By injecting malicious SQL code into this parameter, the attacker can append additional, unauthorized SQL queries to the legitimate database queries that WordPress executes. This allows the attacker to bypass intended restrictions and interact directly with the site's database in ways not permitted by normal application logic.

The primary impact of this SQL injection is the extraction of sensitive information from the database. This could include user credentials, site configuration details, or other proprietary data stored within the WordPress database. In a more severe scenario, when this SQL injection issue is combined with a separate REST API batch-route confusion vulnerability, it can lead to Remote Code Execution (RCE). This means an attacker could potentially execute arbitrary code on the server hosting the WordPress site, gaining full control over the system. The vulnerability is particularly concerning because it can be exploited by unauthenticated individuals, meaning an attacker does not need to log in or have any special privileges to initiate an attack.

How to detect a compromise

Detecting a compromise related to this specific SQL Injection vulnerability requires careful examination of various system and application logs. Indicators of compromise might include unusual database query patterns, especially those involving the author__not_in parameter, or unexpected data exfiltration from the database. Reviewing web server access logs for suspicious requests targeting WordPress endpoints with manipulated author__not_in parameters could also provide clues. Additionally, monitoring for any unauthorized file modifications or new user accounts, particularly if the SQL injection was chained with a Remote Code Execution vulnerability, is advisable.

However, the available evidence does not provide specific indicators of compromise, file paths, or specific grep or WP-CLI commands tailored for detecting exploitation of CVE-2026-60137. Site administrators should maintain robust logging practices and regularly review logs for anomalies that could suggest unauthorized activity.

How to fix

Addressing CVE-2026-60137 requires an immediate update to a patched version of WordPress Core. These security updates resolve the facilitated SQL injection issue by implementing proper sanitization and escaping for the author__not_in parameter, thereby preventing attackers from injecting malicious SQL code.

WordPress versions 6.8.6, 6.9.5, and 7.0.2 were released on July 17, 2026, specifically to address this vulnerability. Users of affected WordPress installations should update their sites without delay.

To update WordPress, administrators have two primary methods:

Via the WordPress Dashboard: Log into the WordPress administration area, navigate to the 'Dashboard' menu, and then select 'Updates'. Follow the on-screen prompts to install the latest available version.
Manual Update: Download the latest WordPress version from the official wordpress.org website. Then, follow the manual update instructions provided by WordPress, which typically involve replacing core files on the server.

Updating to one of the patched versions (6.8.6, 6.9.5, or 7.0.2) will mitigate the SQL injection vulnerability. Given that public exploitation tools are available and active attacks have been observed, prompt action is essential to protect WordPress sites from potential compromise.

Timeline

Date	Event
2026-07-17	Record published
2026-07-17	Wordfence rule released
2026-07-17	Patched versions released