---
id: CVE-2026-60137
title: >-
  WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does
  not properly sanitise the author__not_in parameter of WP_Query, which could
  allow SQL Injection when a plugin or theme passes untrusted input to the
  parameter.
summary: >-
  WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does
  not properly sanitise the author__not_in parameter of WP_Query, which could
  allow SQL Injection when a plugin or theme passes untrusted input to the
  parameter.
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-89
published: '2026-07-17'
updated: '2026-07-18'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-60137'
references:
  - url: >-
      https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
    label: contact@wpscan.com
  - url: 'https://wordpress.org/news/2026/07/wordpress-7-0-2-release/'
    label: contact@wpscan.com
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.78305
epssPercentile: 0.99559
ingestedAt: '2026-07-18T21:25:08.011Z'
kev: true
exploited: true
kevDateAdded: '2026-07-21'
kevDueDate: '2026-08-04'
kevRansomware: false
exploits:
  github: 11
  githubRepos:
    - 'https://github.com/codeb0ssx/Ultimate-wp2shell'
    - 'https://github.com/Colere-Sys/wp2shell-poc'
    - 'https://github.com/ebrasha/abdal-cve-2026-60137'
  metasploit:
    - auxiliary/scanner/http/wordpress_wp2shell_sqli
    - exploit/multi/http/wp_batch_desync_rce
  checkedAt: '2026-09-23T07:14:28.394Z'
exploitAvailable: true
---

## Overview

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.