WordPress · Core
CVE-2026-60137
WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query
O que é
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CISA: WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
O que fazer
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Prazo para as agências federais dos EUA: 4 de agosto de 2026
Mais falhas exploradas de WordPress
| Adicionado | Vulnerabilidade | Produto | Gravidade | Chance de ataque |
|---|---|---|---|---|
| 25 de set. de 2026 | Remote File Inclusion | Core | Alto 8,1 | 96% |
| 21 de jul. de 2026 | Interpretation Conflict | Core | Crítica 9,8 | 11% |
| 3 de nov. de 2021 | Cross-Site Scripting (XSS) | Social Warfare Plugin | Média 6,1 | 73% |
| 3 de nov. de 2021 | File Download | Snap Creek Duplicator Plugin | Alto 7,5 | 98% |
| 3 de nov. de 2021 | Remote Code Execution | File Manager Plugin | Crítica 10,0 | 97% |
Fontes: Known Exploited Vulnerabilities (CISA, domínio público), CVE records (cve.org) e EPSS (FIRST). A chance de ataque é a estimativa EPSS de que alguém tente explorar a falha nos próximos 30 dias.