Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query - CVE-2026-60137 - Vulnerability Database
WordPress

Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query - CVE-2026-60137

Critical
Reference: CVE-2026-60137
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-60137
Title: Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query
Overview:

WordPress 6.8.x before 6.8.6 6.9.x before 6.9.5 and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.