CVE-2026-60137

Imagine WordPress is building a “search filter” for who should be included or excluded from a list (WP_Query). This flaw lets bad input sometimes be treated like executable database instructions if a plugin or theme passes the wrong kind of data into that filter. Attackers have been actively using it to break into sites and plant malicious backdoors.

This matters if you run WordPress versions prior to 6.8.6, 6.9.5, or 7.0.2, and you use plugins or themes that can reach WP_Query’s author__not_in with untrusted input. Because this has been exploited in the wild, even sites with typical plugin/theme setups should treat it as urgent. The reachability depends on whether the vulnerable parameter is reachable via your plugin/theme, and attackers can be attempting scans against internet-facing sites.

RED: Attackers are already exploiting CVE-2026-60137 in the wild, and CISA added it to their KEV list. Real incidents include steps like installing webshells and creating administrative accounts, which can lead to full site compromise. You should treat this as an immediate patching and incident-checking priority.