SQL Injection Affecting johnpbloch/wordpress-core package, versions >=6.8.0, <6.8.6>=6.9.0, <6.9.5>=7.0.0, <7.0.2
Threat Intelligence
This vulnerability is trending on Twitter; this may indicate a growing threat.
Snyk has reported that there have been attempts or successful attacks targeting this vulnerability.
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-PHP-JOHNPBLOCHWORDPRESSCORE-18134059
- published21 Jul 2026
- disclosed16 Jul 2026
- creditTF1T, dtro, haongo
Introduced: 16 Jul 2026
CVE-2026-60137 (opens in a new tab)How to fix?
Upgrade johnpbloch/wordpress-core to version 6.8.6, 6.9.5, 7.0.2 or higher.
Overview
johnpbloch/wordpress-core is a web software you can use to create a website or blog.
Affected versions of this package are vulnerable to SQL Injection in the WP_Query::get_posts() method of class-wp-query.php, which applies integer casting to the author__not_in query variable only when it is an array and otherwise concatenates the value directly into the post_author NOT IN (...) clause. An attacker can inject SQL into the posts query by supplying author__not_in as a non-array scalar value that reaches WP_Query, and on 6.9 and later this can be escalated to remote code execution when combined with the REST API batch-route confusion issue. Exploitation is facilitated rather than direct, requiring a code path that passes an attacker-influenced non-array author__not_in value into WP_Query, and the remote code execution escalation additionally depends on the 6.9+ REST API batch-route behavior.