CVE-2026-60137
Medium5.9CISA KEV — exploited in the wildWordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Querytitle from the CVE record
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
- CVSS
- 5.9v3.1
- EPSS (exploit probability)
- 5.3%93th pct
- CISA KEV
- Listed
EPSS trendFIRST daily scores, last 90 days
Daily values
| Score date | EPSS | Percentile |
|---|---|---|
| 2026-10-25 | 5.3% | 92.6% |
| 2026-10-24 | 5.3% | 92.6% |
| 2026-10-23 | 5.3% | 92.6% |
| 2026-10-22 | 5.3% | 92.6% |
| 2026-10-21 | 5.3% | 92.6% |
| 2026-10-20 | 5.3% | 92.5% |
| 2026-10-19 | 5.3% | 92.5% |
| 2026-10-18 | 5.3% | 92.5% |
| 2026-10-17 | 5.3% | 92.5% |
| 2026-10-16 | 5.3% | 92.5% |
| 2026-10-15 | 5.3% | 92.5% |
| 2026-10-14 | 5.3% | 92.5% |
| 2026-10-13 | 5.3% | 92.4% |
| 2026-10-12 | 5.3% | 92.4% |
| 2026-10-11 | 5.3% | 92.4% |
| 2026-10-10 | 5.3% | 92.4% |
| 2026-10-09 | 5.3% | 92.4% |
| 2026-10-08 | 5.3% | 92.4% |
| 2026-10-07 | 5.9% | 93.0% |
| 2026-10-06 | 5.9% | 93.0% |
| 2026-10-05 | 5.9% | 93.0% |
| 2026-10-04 | 5.9% | 93.0% |
| 2026-10-03 | 5.9% | 93.0% |
| 2026-10-02 | 5.9% | 93.0% |
| 2026-10-01 | 5.9% | 93.0% |
| 2026-09-30 | 5.9% | 93.0% |
| 2026-09-29 | 5.9% | 93.0% |
| 2026-09-27 | 5.9% | 93.0% |
| 2026-09-26 | 5.9% | 93.0% |
| 2026-09-25 | 5.9% | 93.0% |
| 2026-09-24 | 5.9% | 93.0% |
CISA KEV entrycatalogue 2026.10.23
- Date added
- 2026-07-21
- Federal due date
- 2026-08-04
- Known ransomware use
- Unknown
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Verbatim from the CISA KEV catalogue (CISA KEV, fetched 2026-10-26 06:51 UTC). The due date applies to US federal agencies under BOD 22-01.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
- wordpress wordpress