CVE-2026-60137: WordPress Core SQL Injection Vulnerability
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.
Overview
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Vulnerability details
WordPress Core fails to sanitize the `author__not_in` parameter of `WP_Query` before incorporating its value into a database query. When a plugin or theme accepts external input and passes it to this parameter without independent validation, the unsanitised value is interpolated directly into SQL, producing a CWE-89 injection condition. The flaw is described as facilitated because WordPress Core is the vulnerable component, but the attack path requires an intermediary plugin or theme to relay attacker-controlled data to the parameter. Affected versions span the 6.8.x, 6.9.x, and 7.0.x release lines.
An attacker submits crafted input through whatever HTTP interface a vulnerable plugin or theme exposes, such as a query parameter, form field, or REST API argument, that the plugin or theme then passes to `WP_Query` via `author__not_in`. The injected SQL payload can read or write database contents, including credential hashes, user data, and site configuration. When chained with CVE-2026-63030, an unauthenticated attacker can escalate from SQL injection to remote code execution on default WordPress installations. Exploitability depends on a susceptible plugin or theme being present and passing external input to the affected parameter.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review web server and application logs for requests containing SQL metacharacters (quotes, comment sequences, UNION keywords) in parameters passed to WordPress query endpoints, where no matching authenticated session exists.
- Audit installed plugins and themes for direct use of `author__not_in` in `WP_Query` calls that accept unsanitised user-supplied input, particularly in public-facing or REST API contexts.
Remediation
Additional hardening
- Restrict public network access to WordPress installations to known IP ranges where operationally feasible, reducing the pool of potential attackers.
- Audit all installed plugins and themes for code that passes request parameters directly to `WP_Query` arguments, prioritizing public-facing and REST API handlers.
- Deploy a web application firewall rule set that inspects and blocks SQL injection patterns in WordPress query parameters as a compensating control.
- Run WordPress under a database account with the minimum required privileges, preventing write operations if read-only access is sufficient for the application.
Key dates
References
Frequently asked questions
Does CVE-2026-60137 affect my FedRAMP authorization?
If WordPress Core runs inside your authorization boundary, yes. CVE-2026-60137 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, which carries a remediation deadline of August 4, 2026. For a FedRAMP-authorized service, an unpatched KEV in your boundary is a finding — one you either remediate or formally document a mitigation for before your assessor and sponsoring agency raise it.
How does Knox help me handle CVE-2026-60137?
Knox doesn't patch your software for you — remediating WordPress Core is your responsibility under the FedRAMP shared responsibility model. What Knox gives you is the pre-authorized, single-tenant boundary to remediate in, plus continuous compliance monitoring and audit-artifact coverage that help you document the fix for your next assessment. The fix is yours to apply; staying compliant while you apply it isn't something you manage alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's continuous monitoring, powered by KnoxAI, watches your environment in real time for newly disclosed vulnerabilities and compliance issues. Exposure surfaces as part of ongoing monitoring — not only when an assessor flags it at review time.
How do I get FedRAMP authorized with Knox?
Book a meeting and Knox maps your path — FedRAMP in 90 days for 90% less, without dependency or delay.
What happens if CVE-2026-60137 isn't remediated by August 4, 2026?
It becomes a POA&M item, and a growing POA&M list is what turns a routine continuous-monitoring review into a real conversation with your agency. Meeting the deadline keeps your authorization clean and the agency relationship intact.
What this vulnerability means for your FedRAMP compliance
Because this flaw is in CISA's Known Exploited Vulnerabilities catalog, FedRAMP continuous monitoring puts a hard remediation clock on it. The clock starts on awareness — and missing the deadline can put an Authority to Operate at risk.
FedRAMP remediation deadlines for actively exploited vulnerabilities
FedRAMP ConMon SLAs give cloud providers 30, 90, or 180 days by severity — but KEV-listed flaws carry the tighter CISA deadline shown above. For authorized services, that date is the compliance line that assessors and agency sponsors will check.
How Knox reduces the burden of CVE vulnerabilities
Remediating the flaw is your responsibility under the FedRAMP shared responsibility model — but staying compliant while you fix it isn't something you manage alone. KnoxAI's continuous monitoring surfaces exposure in real time, and Knox keeps your continuous-monitoring evidence and audit artifacts current while you apply the fix. Learn more about the Knox platform.
How to limit your exposure through inherited controls and isolation
Knox's single-tenant architecture gives every customer a dedicated boundary, and 60–80% of FedRAMP controls are inherited from the platform — shrinking the surface you have to patch and prove. See why teams choose Knox.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
