WordPress WP_Query author__not_in SQL injection (wp2shell companion)

CVE-2026-60137 is the SQL injection companion to the wp2shell RCE (CVE-2026-63030), reported by Adam Kues of Searchlight Cyber and disclosed alongside the RCE. Per NVD, the flaw is that WordPress WP_Query “does not properly sanitise the author__not_in parameter,” which “could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.”

Scoring and severity

• CVSS: 5.9 (medium) per NVD.
• CISA now frames it as chainable to RCE. CISA’s KEV entry for CVE-2026-60137, added July 21, 2026, states the flaw “can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.” That reframes the initial Rapid7/Searchlight write-up, which treated the two as distinct primitives. Treat the effective severity as critical wherever CVE-2026-63030 is unpatched.
• Plugin/theme-mediated. Exploitation of the SQLi primitive on its own still requires a plugin or theme that passes user-controlled input into author__not_in; the chain to RCE via CVE-2026-63030 does not require that path per CISA.

Affected and patched

Per the wordpress.org 7.0.2 release announcement and BleepingComputer’s July 18 coverage:

• In range: WordPress 6.8.0–6.8.5, 6.9.0–6.9.4, and 7.0.0–7.0.1.
• Patched: 6.8.6, 6.9.5, or 7.0.2.

Note that the 6.8 branch is in range for this SQLi but was not in range for the wp2shell RCE. Sites still on 6.8.x should patch to 6.8.6 if any plugin or theme could pipe untrusted input into author__not_in.

What to do

Update to the patched release for your branch. If your 6.8.x-only stance was based on wp2shell not affecting 6.8.x, this SQLi is the reason to revisit that call. The KEV addition on July 21, 2026 constitutes government confirmation of exploitation; see the KEV coverage and the July 20 wp2shell follow-up for the full timeline.