CVE-2026-60137: SQL Injection in WordPress Core WP_Query Class via author__not_in Parameter

The WP_Query class serves as the fundamental engine within WordPress for querying posts, pages, and custom post types from the underlying database. It handles complex filtering options, including category restrictions, date ranges, and author parameters.

To allow developers to exclude specific author IDs from query results, the WP_Query class exposes parameters such as author__not_in and author_exclude. These parameters accept arrays of integers representing the author IDs to be omitted from the database query execution.

Because WordPress Core is designed to process highly structured, nested input, many plug-ins and themes forward client-supplied parameters directly to WP_Query. If the input is not strictly validated, malicious arrays can reach the query generator, breaking the boundary of the SQL statement and exposing a significant attack surface.

The underlying vulnerability represents a failure in parameter sanitization within the WP_Query::get_posts() method. While modern Database Abstraction Layers (DBAL) enforce prepared statements with parameter binding, legacy structures in WordPress still construct several SQL fragments dynamically.

During query construction, the author__not_in parameter is processed to generate a SQL string within the WHERE block. Ideally, WordPress should force integer type-casting on each element inside the array before concatenating it. In the vulnerable versions, the sanitization wrapper fails to properly clean elements that are not explicitly numeric.

Because the raw strings bypass sanitization, they are inserted directly into the query template. This structural weakness allows an attacker to supply a crafted array containing subqueries, UNION statements, or blind time-based SQL payloads. The final dynamically built query is executed directly via the $wpdb class, resulting in execution of unauthorized database commands.

The following representation shows the vulnerable code path inside wp-includes/class-wp-query.php compared with the security patch introduced in the fixed versions.

// Vulnerable Implementation
if ( ! empty( $q['author__not_in'] ) ) {
    // Vulnerability: The array values are directly converted to string fragments without rigorous integer type-casting
    $author__not_in = implode( ',', array_map( 'trim', (array) $q['author__not_in'] ) );
    $this->query_vars['author__not_in'] = $author__not_in;
    $where .= " AND wp_posts.post_author NOT IN ($author__not_in)";
}

// Patched Implementation
if ( ! empty( $q['author__not_in'] ) ) {
    // Fix: Explicitly map 'intval' to force type-casting of all array inputs to safe integers
    $author__not_in = array_map( 'intval', (array) $q['author__not_in'] );
    $author__not_in_string = implode( ',', $author__not_in );
    $this->query_vars['author__not_in'] = $author__not_in;
    $where .= " AND wp_posts.post_author NOT IN ($author__not_in_string)";
}

By forcing every item in the author__not_in array to resolve to an integer via the intval function, any injected SQL syntax or non-numeric payload is neutralized to 0. The patch successfully prevents attackers from inserting nested subqueries or executing dynamic database actions.

While CVE-2026-60137 represents a medium-severity vulnerability on its own due to the lack of an unauthenticated vector, it has been paired with CVE-2026-63030 in an active exploit chain known as wp2shell.

The attack mechanism leverages the REST API Batch endpoint to achieve pre-authentication route desynchronization. The attacker sends a nested JSON batch payload to the /?rest_route=/batch/v1 endpoint, confusing the internal routing framework and bypassing permissions checks. Once unauthorized REST API endpoints are accessible, the attacker targets handlers that pass parameters directly to WP_Query.

The SQL injection payload is delivered through the author_exclude or author__not_in parameter. It is executed to retrieve administrator hash values from the wp_users table. In advanced stages of the attack, write operations are performed against the wp_options table to register a malicious plugin or overwrite page templates, achieving arbitrary PHP code execution on the hosting server.

The impact of CVE-2026-60137 when evaluated as part of the wp2shell exploit chain is critical. An unauthenticated attacker can achieve complete read access to the database, allowing for the extraction of sensitive secrets, application salts, and password hashes.

Additionally, direct write access to the database enables attackers to perform persistent administrative privilege escalation. Attackers regularly alter option parameters in the database to register backdoors, modify configuration details, or load remote files.

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog. Threat intelligence reports indicate widespread active scanning and exploitation of public-facing WordPress instances.

To fully address this vulnerability, administrators must apply the security updates immediately. The WordPress Security Team has backported the patch to several active release lines.

Update your environments to one of the following versions based on your current installation:

• Release Line 6.8.x: Upgrade to 6.8.6 or newer
• Release Line 6.9.x: Upgrade to 6.9.5 or newer
• Release Line 7.0.x: Upgrade to 7.0.2 or newer

If immediate updates cannot be executed, block POST requests to /wp-json/batch/v1 and /?rest_route=/batch/v1 at your Web Application Firewall (WAF) or web server configuration. This temporarily mitigates the wp2shell exploit chain by eliminating the pre-authentication route desynchronization entry point.