Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query` (CVE-2026-60137) - Vulnerability Database

Facilitated SQL injection vulnerability in the `author__not_in` parameter of `WP_Query` (CVE-2026-60137)

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

References

CVE-2026-60137

Related Vulnerabilities

Joomla Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2022-23794) Medium
Common tags: Missing Update Known Vulnerabilities
MySQL CVE-2020-2896 Vulnerability (CVE-2020-2896) Medium
Common tags: Missing Update Known Vulnerabilities
Oracle JRE CVE-2020-2816 Vulnerability (CVE-2020-2816) High
Common tags: Missing Update Known Vulnerabilities
WebLogic CVE-2020-2828 Vulnerability (CVE-2020-2828) High
Common tags: Missing Update Known Vulnerabilities
WebLogic CVE-2020-2829 Vulnerability (CVE-2020-2829) Medium
Common tags: Missing Update Known Vulnerabilities

Severity

Critical

Classification

CVE-2026-60137

Tags

Missing Update
Known Vulnerabilities