CVE-2026-60137: SQL injection in WordPress core, now on CISA's KEV list

CVE-2026-60137: SQL injection in WordPress core, now on CISA's KEV list

In short

A SQL injection vulnerability has been published in WordPress core, identified as CVE-2026-60137, which is already listed in CISA's Known Exploited Vulnerabilities (KEV) catalog [2]. It affects WordPress installations across several version branches [1]. If you manage a WordPress website, today's action is simple: check your core version and update as soon as possible.

What it is and why it matters

CVE-2026-60137 is a sanitization flaw in the author__not_in parameter of WP_Query, an internal component of WordPress core. According to the official description, the issue allows SQL injection when a plugin or theme passes untrusted input to that parameter [1]. It is rated with a CVSS score of 5.9 and "medium" severity according to NVD [1], published on July 17, 2026 [1].

What raises the urgency is not the score in isolation, but two factors: first, CISA has already added it to its KEV catalog, indicating confirmed active exploitation in the real world [2]. Second, our OCIRIA intelligence radar has detected that this flaw can be chained with another vulnerability, CVE-2026-63030, to achieve remote code execution without prior authentication [3]. In other words: although the SQL injection alone is already serious, the real risk for many sites is greater than the CVSS score alone suggests, because an attacker could gain control of the server by combining both flaws [3].

It's worth emphasizing that this last point — the chaining with CVE-2026-63030 — is a finding from our own analysis and not data collected in NVD or the KEV registry [3]; we share it because we believe it provides useful context for prioritizing the response.

Who is affected

According to official data, the following WordPress versions are affected: 6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, and 7.0.x prior to 7.0.2 [1]. The affected vendor is WordPress [1]. In practice, this covers a very large part of the ecosystem, since WordPress is one of the most widely used content management systems by companies of all sizes: online stores, corporate websites, blogs, intranets, and customer acquisition portals.

The risk materializes mainly when installed plugins or themes pass user input (for example, search parameters, filters, or forms) directly to the affected WP_Query function, as described in the technical advisory itself [1]. The more third-party plugins a website has installed, the greater the potential exposure surface.

How to know if you're vulnerable

You don't need to be technical to do a first check:

• Log into the WordPress admin panel and check the core version in the "Updates" panel. If it is earlier than 6.8.6, 6.9.5, or 7.0.2, your installation falls within the affected range [1].
• Review which plugins and themes are active, especially those that display listings, searches, or content filters, as they are the most likely to interact with WP_Query.
• If you manage several websites or domains (agencies, franchises, business groups), it's worth keeping an up-to-date inventory of which CMS and version each public asset runs. It's common to discover "forgotten" installations that no one updates.
• Checking the surface actually exposed to the internet — which domains, subdomains, and admin panels are visible from the outside — is the first step before deciding on patching priorities.

How to protect yourself

1. Update WordPress Core to the most recent version within your branch (6.8.6, 6.9.5, 7.0.2, or later) as soon as possible [1].

2. Review plugins and themes that interact with listings or dynamic queries, and update them too, since the flaw is triggered when they pass unfiltered data to the core [1].

3. Prioritize publicly exposed sites with admin panels accessible from the internet, given that this CVE is already being actively exploited according to CISA [2].

4. Back up before updating, as a standard best practice for any security patch.

5. If you manage multiple sites, automate version control so you don't have to rely on periodic manual reviews.

Brief FAQ

Is this a critical vulnerability? According to NVD, the severity is "medium" with a CVSS of 5.9 [1]. However, its inclusion in CISA's KEV catalog indicates confirmed active exploitation [2], and our internal analysis points to a remote code execution risk when combined with another flaw [3], which is why we recommend treating it as high priority despite the moderate score.

Does it affect all WordPress websites? Only those running versions within the ranges indicated (6.8.x prior to 6.8.6, 6.9.x prior to 6.9.5, 7.0.x prior to 7.0.2) [1]. Updating the core resolves the issue.

Is it enough to update the core? That's the essential step, but it's also worth reviewing active plugins and themes, since they are what expose the attack path by passing unvalidated data to the affected component [1].

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-60137
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json