Act nowKnown exploited

Advisory · CVE-2026-60137

WordPress SQL injection chains into unauthenticated site takeover

A SQL injection in WordPress's author__not_in query parameter, chained with a REST API flaw, gives unauthenticated remote code execution on default installs.

Advisory published July 21, 2026Independent summary
Vendor
WordPress
Product
WordPress Core
Identifier / CWE
CVE-2026-60137
CWE-89
Action timing
Aug 11, 2026
ELI5

Explain it like I’m five

WordPress asks a plugin which authors to hide, but doesn't check the answer for trick wording. A crafted answer slips database commands through, and paired with a second flaw it hands over the whole site.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Untrusted input

    A plugin or theme passes untrusted input to the author__not_in parameter of WP_Query.

  2. 02SQL injection

    WordPress 6.8.x through 7.0.x fail to sanitize the parameter, allowing SQL injection (CVE-2026-60137).

  3. 03Chain with second flaw

    On WordPress 6.9 and higher, this combines with a REST API batch-route confusion issue (CVE-2026-63030).

  4. 04Remote code execution

    The chain yields unauthenticated remote code execution on default WordPress installations.

What happened

CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalog on July 21, 2026. WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 do not properly sanitize the author__not_in parameter of WP_Query, allowing SQL injection when a plugin or theme passes untrusted input to the parameter.

On its own the injection needs a plugin or theme to hand it attacker-controlled input, which is common enough. The dangerous part is the chain: on WordPress 6.9 and higher, this flaw combined with a REST API batch-route confusion issue (CVE-2026-63030) leads to unauthenticated remote code execution on default installations. The vulnerability is scored CVSS 9.1. WordPress responded with security releases 7.0.2, 6.9.5, and 6.8.6 (plus 7.1 beta2) and, citing severity, enabled forced updates via the auto-update system for affected sites. The flaws were reported by researchers TF1T, dtro, and haongo, with the RCE chain reported by Adam Kues of Assetnote / Searchlight Cyber.

What to do

  1. Update WordPress to 7.0.2, 6.9.5, or 6.8.6 immediately, matching your version line; confirm auto-updates actually applied on sites that should have received the forced update.
  2. Audit installed plugins and themes for code passing untrusted input to WP_Query parameters, and update or remove anything unmaintained.
  3. Scan for web shells, unexpected files, and unauthorized administrator accounts, since the chained RCE needs no credentials.
  4. Review access logs for REST API batch requests and odd query parameters in the window before patching.
  5. Rotate salts, admin passwords, and database credentials if compromise cannot be ruled out.

Management note

WordPress powers a huge share of the web, and its security team does not force auto-updates lightly: that step signals they expect mass exploitation of the chained RCE. Most organizations discover during incidents like this that they have far more WordPress sites than their official inventory admits. Finding them all is the real task; patching is the easy part once you know where they are.