logo

Database

Lack of data validation In wordpress

Description

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-601372. NVD-2026-601373. OSV-DEBIAN-2026-601374. OSV-2026-601375. SECURITY-TRACKER-CVE-2026-60137

References

1. https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-601372. https://github.com/h4cd0c/wp2shell3. https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_batch_desync_rce.rb

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.