Description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Published: 2026-07-17
Score: 5.9 Medium
EPSS: 79.0% High
KEV: Yes
Impact: n/a
Action: n/a
AI Analysis

Impact

WordPress versions prior to 6.8.6, 6.9.5, and 7.0.2 fail to sanitize the author__not_in parameter of WP_Query, allowing an attacker to inject arbitrary SQL when a plugin or theme supplies untrusted input to that parameter. This flaw is a classic SQL Injection vulnerability (CWE‑89) that can lead to data exposure, unauthorized data manipulation, or other database compromise.

Affected Systems

WordPress installations running 6.8.x before 6.8.6, 6.9.x before 6.9.5, or 7.0.x before 7.0.2 are affected, particularly when any plugin or theme passes user‑controlled data to the author__not_in argument of WP_Query.

Risk and Exploitability

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of 79% suggests a higher likelihood of exploitation in the wild. The vulnerability is listed in CISA’s KEV catalog. The likely attack vector is remote, achieved through a crafted HTTP request that exploits a plugin or theme’s use of author__not_in. Successful exploitation requires that the plugin or theme supplies unsanitized input to this parameter.

Generated by OpenCVE AI on August 3, 2026 at 02:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WordPress to version 7.0.2 (or 6.8.6/6.9.5 for the corresponding releases) to apply the vendor patch.
  • Identify and update or replace all plugins or themes that supply user input to the author__not_in parameter, ensuring proper validation or sanitization before it is passed to WP_Query.
  • Configure an application firewall or security plugin to detect and block suspicious SQL injection attempts targeting the author__not_in argument, and monitor logs for abnormal query patterns.

Generated by OpenCVE AI on August 3, 2026 at 02:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6399-1 wordpress security update
History

Wed, 29 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-07-21T00:00:00+00:00', 'dueDate': '2026-08-04T00:00:00+00:00'}

Sat, 18 Jul 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

 cvssV3_1

{'score': 5.9, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Fri, 17 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Fri, 17 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-89
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 17 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Description WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Title WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
References

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-07-29T19:26:43.785Z

Reserved: 2026-07-17T17:17:24.479Z

Link: CVE-2026-60137

cve-icon Vulnrichment

Updated: 2026-07-17T19:52:17.964Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T02:45:03Z

Weaknesses
  • CWE-89

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')