Note: This data is for reference and cybersecurity research purposes only.CyStack advises users not to use this information for unlawful purposes.
CVE-2026-60137 is a vulnerability classified as Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), affecting WordPress (affected versions: 6.8.0 – < 6.8.6, 6.9.0 – < 6.9.5, and other affected versions). This vulnerability is rated Critical, with a CVSS score of 9.1. This vulnerability has been observed being exploited in the wild.
Analyzing data...
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en
