WordPress WP_Query author__not_in SQL injection (wp2shell companion)
A medium-severity SQL injection in WordPress WP_Query's author__not_in parameter (CVE-2026-60137). Tracked as the wp2shell companion. Patched in 6.8.6, 6.9.5, and 7.0.2.
- Vendor
- WordPress
- Product
- WordPress Core (6.8.0-6.8.5, 6.9.0-6.9.4, 7.0.0-7.0.1)
- CVSS
- 5.9
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
CVE-2026-60137 is the SQL injection companion to the wp2shell RCE (CVE-2026-63030), reported by Adam Kues of Searchlight Cyber and disclosed alongside the RCE. Per NVD, the flaw is that WordPress WP_Query “does not properly sanitise the author__not_in parameter,” which “could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.”
Scoring and severity
- CVSS: 5.9 (medium) per NVD.
- Not chainable to RCE on its own. This is a distinct primitive from the CVE-2026-63030 unauthenticated RCE and does not extend to code execution.
- Plugin/theme-mediated. Exploitation requires a plugin or theme that passes user-controlled input into
author__not_in.
Affected and patched
Per the wordpress.org 7.0.2 release announcement and BleepingComputer’s July 18 coverage:
- In range: WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1.
- Patched: 6.8.6, 6.9.5, or 7.0.2.
Note that the 6.8 branch is in range for this SQLi but was not in range for the wp2shell RCE. Sites still on 6.8.x should patch to 6.8.6 if any plugin or theme could pipe untrusted input into author__not_in.
What to do
Update to the patched release for your branch. If your 6.8.x-only stance was based on wp2shell not affecting 6.8.x, this SQLi is the reason to revisit that call. In-the-wild exploitation of this specific SQLi has not been named-vendor reported at the time of this stub; see the July 20 wp2shell follow-up for status.
