CVE-2026-60137

Name of the Vulnerable Software and Affected Versions WordPress versions 6.8.0 through 6.8.5 WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1

Description WordPress Core contains a critical vulnerability chain involving an SQL Injection and a remote code execution flaw. The issue stems from the WP Query class, specifically within the get items() function, where the author not in parameter is not properly sanitized or escaped. This allows an unauthenticated remote attacker to append malicious SQL queries to existing ones, potentially extracting sensitive information from the database. Furthermore, a synchronization failure between the permission check array, the allowed endpoints list, and the execution array can be exploited to bypass security restrictions, execute arbitrary code on the server, and gain unauthorized access to protected information. This vulnerability chain is particularly critical as it involves the WordPress REST API.

Recommendations Update WordPress to version 6.8.6. Update WordPress to version 6.9.5. Update WordPress to version 7.0.2. As a temporary mitigation, restrict access to the WordPress REST API to minimize the risk of exploitation.