CVE-2026-60137

Imagine WordPress is building a “search filter” for who should be included or excluded from a list (WP_Query). This flaw lets bad input sometimes be treated like executable database instructions if a plugin or theme passes the wrong kind of data into that filter. Attackers have been actively using it to break into sites and plant malicious backdoors.

This matters if you run WordPress versions prior to 6.8.6, 6.9.5, or 7.0.2, and you use plugins or themes that can reach WP_Query’s author__not_in with untrusted input. Because this has been exploited in the wild, even sites with typical plugin/theme setups should treat it as urgent. The reachability depends on whether the vulnerable parameter is reachable via your plugin/theme, and attackers can be attempting scans against internet-facing sites.

RED: Attackers are already exploiting CVE-2026-60137 in the wild, and CISA added it to their KEV list. Real incidents include steps like installing webshells and creating administrative accounts, which can lead to full site compromise. You should treat this as an immediate patching and incident-checking priority.

1. Confirm exposure

   • Check the WordPress version shown in your WordPress admin area (or via your hosting panel / About page).
   • Determine which fixed version line applies:
     • WordPress 6.8.x must be upgraded to 6.8.6 or later.
     • WordPress 6.9.x must be upgraded to 6.9.5 or later.
     • WordPress 7.0.x must be upgraded to 7.0.2 or later.
   • Identify whether you have plugins/themes that use WP_Query with author__not_in fed from user-controlled input (forms, URL parameters, search fields, custom endpoints). If you cannot quickly validate this, assume risk is present because exploitation has been reported.

2. Upgrade to fixed WordPress core

   • Perform the WordPress core update to the fixed version appropriate for your branch (6.8.6 / 6.9.5 / 7.0.2).
   • After upgrading, verify the update completed successfully and that the site loads normally.

3. Post-upgrade compromise checks (because exploitation is confirmed)

   • Check for new admin users created around the time you suspect exposure.
   • Review recently changed plugins/themes and compare against your known-good list.
   • Look for webshell indicators in common web-accessible upload/plugin directories (using your hosting provider’s file scanning tools if available).
   • Review web server logs and WordPress activity logs for suspicious requests tied to the exploitation window.

4. Temporary workaround if you cannot patch immediately

   • Remove or disable plugins/themes that may pass untrusted input into author__not_in via WP_Query, especially any custom or lesser-known components.
   • If possible, restrict access to any functionality that accepts user-controlled input influencing author__not_in.
   • Keep the site under close monitoring until core is patched.

5. CISA KEV timing and what to monitor

   • CISA KEV remediation due date: 2026-08-04.
   • Monitor for ongoing scanning and follow-on behaviors (new admin accounts, unexpected plugin/theme additions/changes, and suspicious outbound connections if your host provides that visibility).

Severity/impact: Classified as RED in this assessment due to confirmed real-world exploitation and the high likelihood of follow-on compromise (webshells, new admin accounts, arbitrary command execution via exploitation chains).

Weakness: CWE-89 (SQL Injection).

Mechanism: WordPress WP_Query has insufficient sanitization for the author__not_in parameter. If a plugin or theme passes untrusted input into author__not_in, an attacker can inject malicious SQL through network requests.

Attack vector and prerequisites: Network-based. No authentication and no user interaction are required for the vulnerability itself, but exploitation requires that a plugin/theme makes the vulnerable parameter reachable with untrusted input.

Exploitation status: CISA KEV lists CVE-2026-60137 as exploited in the wild (added 2026-07-21), and news reports describe mass scanning and malicious actions including webshell deployment and administrative account creation, as part of an attack chain.

EPSS: A rising prediction was noted, but KEV/news exploitation status takes precedence in treating this as actively exploited rather than purely theoretical.

Fix: Patched in WordPress core versions 6.8.6, 6.9.5, and 7.0.2.