CVE-2026-60137 – WordPress
“When attackers can chain vulnerabilities together, a routine update becomes a business-critical priority.”
This WordPress security update addresses two related vulnerabilities affecting multiple WordPress releases. The update fixes an SQL injection issue in the author__not_in parameter of WP_Query and a REST API batch endpoint route confusion issue. When combined, these vulnerabilities could allow an attacker to perform SQL injection and potentially achieve remote code execution.
CVE-2026-60137 has a CVSS score of 5.9, Medium severity. It affects the handling of untrusted input passed to the author__not_in parameter by plugins or themes, potentially enabling SQL injection.
CVE-2026-63030 has a CVSS score of 9.8, Critical severity. It affects the REST API batch endpoint route handling and, when chained with CVE-2026-60137, could allow SQL injection leading to remote code execution. Public proof-of-concept (PoC) code is available for these vulnerabilities.
Key Details
- Affected Product
- Wordpress Wordpress
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-89