## Overview
CISA has added CVE-2026-60137 to its Known Exploited Vulnerabilities (KEV) list. This vulnerability affects WordPress Core versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2. It allows SQL injection through the improper sanitization of the author__not_in parameter in WP_Query. The addition to the KEV list indicates a federal deadline for remediation, highlighting the urgency of this issue.
## Technical Details
The vulnerability arises when plugins or themes pass untrusted input to the author__not_in parameter without proper sanitization. Attackers can exploit this flaw to execute arbitrary SQL commands. This vulnerability can be chained with CVE-2026-63030, which may allow unauthenticated attackers to achieve remote code execution on default WordPress installations. The CVSS score for this vulnerability is 5.9, indicating a moderate severity level.
## Impact
If exploited, this vulnerability can lead to unauthorized access to sensitive data and potentially full control over the affected WordPress site. The risk is heightened for sites using vulnerable versions of WordPress that do not implement proper input validation. The exploitation evidence suggests that attackers are actively scanning for vulnerable installations, making timely patching crucial.
## Mitigation
Defenders should immediately update their WordPress installations to versions 6.8.6, 6.9.5, or 7.0.2 or later. Regularly check for updates and apply security patches promptly. Additionally, review and sanitize any user inputs in custom themes or plugins to prevent SQL injection risks. Implementing web application firewalls (WAFs) can also help mitigate potential attacks.
CSURFACE Threat Sensor