cve-2026-60137

{
  "cvss": 5.9,
  "datePublished": "",
  "dateUpdated": "",
  "description": "Affected: WordPress Foundation / WordPress | Description: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter. EU victimology. | Patched since: 2026/07/17 | Exploitation type: unknown | CWEs: CWE-89 | Origin source: ENISA | Notes: https://www.greynoise.io/blog/open-season-on-kapibala-attacker-steals-government-records-wordpress-exploitation#:~:text=GreyNoise%20discovered%20the%20MCA%20targeted%20ZyXEL%20GS1900%20Smart%20Managed%20Switches%20globally, https://www.wiz.io/blog/wp2shell-cve-2026-63030-cve-2026-60137",
  "dueDate": "",
  "exploited": true,
  "id": "CVE-2026-60137",
  "kev_catalogs": [
    "circl"
  ],
  "knownRansomwareCampaignUse": "",
  "product": "WordPress",
  "severity": "MEDIUM",
  "source": "circl_kev",
  "title": "CVE-2026-60137",
  "vendor": "WordPress Foundation"
}