CVE-2026-60137: WordPress Core SQL Injection Vulnerability
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the authornotin parameter of WPQuery, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Other sources
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 6.8.6 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 6.9.5 - Upgrade
Upgrade
WordPressto a version that resolves this vulnerability.Fixed in 7.0.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60137?
The severity of CVE-2026-60137 is critical, with a CVSS score of 9.1.
How do I fix CVE-2026-60137?
To fix CVE-2026-60137, update WordPress to version 7.0.2 or later.
What type of vulnerability is CVE-2026-60137?
CVE-2026-60137 is an SQL Injection vulnerability.
Which versions of WordPress are affected by CVE-2026-60137?
WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 are affected by CVE-2026-60137.
What could happen if CVE-2026-60137 is exploited?
If exploited, CVE-2026-60137 could allow an attacker to execute arbitrary SQL commands in the database.