CVE-2026-60137
Description
CVE-2026-60137 is a medium-severity SQL injection vulnerability in WordPress Core (versions 6.8-7.0) actively exploited in the wild.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| wordpress | 6.8 | 6.8.6 | vulnerable |
| wordpress | 6.9 | 6.9.5 | vulnerable |
| wordpress | 7.0 | 7.0.2 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Immediately update WordPress Core to the latest security releases provided by the vendor. The vulnerability is addressed in versions 6.8.6, 6.9.5, and 7.0.2.
Update affected systems
Ensure all installations running WordPress versions 6.8.x, 6.9.x, or 7.0.x are upgraded to at least 6.8.6, 6.9.5, or 7.0.2 respectively to remediate the SQL injection flaw.
Restrict access
Deploy Web Application Firewall (WAF) rules to filter and block malicious SQL injection patterns in HTTP request parameters, specifically targeting those that interact with WP_Query components.
Monitor for exploitation
Audit database and web server logs for unusual query patterns involving the author__not_in parameter. Monitor for unauthorized database access or unexpected administrative account activity.
Detection Guidance
"Security teams should monitor web server access logs for suspicious requests containing SQL syntax or unexpected characters within the author__not_in parameter. Specifically, look for payloads attempting to break out of SQL strings or using UNION-based injection techniques. Utilizing a Web Application Firewall (WAF) with signatures for SQL injection (SQLi) can help identify and block these attempts. Additionally, audit database query logs for anomalies originating from the WordPress WP_Query class."