CISA has added CVE-2026-60137, a SQL injection flaw in WordPress Core, to its Known Exploited Vulnerabilities catalog, confirming active exploitation of a bug that can be chained to unauthenticated remote code execution.
What Is It
CVE-2026-60137 is a SQL injection vulnerability (CWE-89) in WordPress Core. WordPress does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL injection when a plugin or theme passes untrusted input to the parameter. The flaw carries a primary CVSS 3.1 base score of 5.9 (MEDIUM), with a secondary score of 9.1 (CRITICAL) also published in the NVD record.
Why It Matters
CISA added this CVE to the KEV catalog on 2026-07-21, and the NVD SSVC assessment lists exploitation status as "active," confirming attackers are exploiting it in the wild. According to the KEV entry, the vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Given WordPress's ubiquity, the potential for unauthenticated RCE on default installs makes this a high-priority issue.
What's Vulnerable
The following WordPress Core versions are affected:
- 6.8.x before 6.8.6
- 6.9.x before 6.9.5
- 7.0.x before 7.0.2
The vulnerability is reachable when a plugin or theme passes untrusted input to the author__not_in parameter.
Patch Status
Fixed versions are available: WordPress 6.8.6, 6.9.5, and 7.0.2. CISA's required action is to apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 guidance and Forensics Triage Requirements. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. The remediation due date is 2026-08-04. Known ransomware campaign use is listed as "Unknown."
Sources
- CISA KEV Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137
- NVD, CVE-2026-60137, https://nvd.nist.gov/vuln/detail/CVE-2026-60137
- WordPress 7.0.2 Release; https://wordpress.org/news/2026/07/wordpress-7-0-2-release/
- WordPress Security Advisory (GHSA-fpp7-x2x2-2mjf), https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-fpp7-x2x2-2mjf
- CISA BOD 26-04; https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk