CVE-2026-60137

Name of the Vulnerable Software and Affected Versions WordPress versions 6.8.0 through 6.8.5 WordPress versions 6.9.0 through 6.9.4 WordPress versions 7.0.0 through 7.0.1

Description WordPress Core contains a critical vulnerability chain. The issue stems from the WP Query class failing to properly sanitize the author not in parameter, which allows for SQL Injection when a plugin or theme passes untrusted input to this parameter. Additionally, a synchronization issue exists within the get items() function involving the permissions check array, the allowed endpoints list, and the execution array. An unauthenticated remote attacker can exploit these flaws to bypass security restrictions, execute arbitrary code on the server, and gain unauthorized access to confidential information via the WordPress REST API.

Recommendations Update WordPress to version 6.8.6. Update WordPress to version 6.9.5. Update WordPress to version 7.0.2.