WordPress 7.0.2 fixes two KEV-listed bugs, CVE-2026-60137 and 63030

WordPress released 7.0.2 on 17 July 2026, with backports to 6.9.5 and 6.8.6. Four days later, on 21 July, CISA added both of its security fixes to the Known Exploited Vulnerabilities catalog: CVE-2026-60137 and CVE-2026-63030.

What's affected

• CVE-2026-60137: WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5 and 7.0.x before 7.0.2. The author__not_in parameter of WP_Query is not sanitised, which allows SQL injection when a plugin or theme passes untrusted input to it. NVD scores it 5.9, because exploitation depends on that plugin or theme behavior.
• CVE-2026-63030: a REST API batch route confusion and SQL injection issue that can lead to remote code execution, reported by Adam Kues of Assetnote and Searchlight Cyber. The release post lists 6.9 and 7.1 beta as affected and fixed in 6.9.5 and 7.1 beta2.
• WordPress versions before 6.8 are not affected by either, according to the release post.

The release post says forced automatic updates are enabled for affected sites.

What to do now

1. Check your version and update: wp core version, then wp core check-update and wp core update.
2. Confirm that background updates actually ran, especially on hosts that disable them or pin versions.
3. Search custom code for the parameter, since the first bug needs untrusted input to reach it:

grep -rn "author__not_in" wp-content/plugins wp-content/themes

4. Where a match takes request data, cast it to integers with array_map('intval', $ids) before it reaches WP_Query.
5. Review the database and web logs for odd REST batch requests from before the update.

How this could have been avoided

• Automatic core updates left on. A four day gap between release and KEV listing is easy to cover if updates apply themselves.
• Validate input at the edge of your own code. The first bug needed a plugin to pass unchecked values. Typing and casting input stops it even before WordPress is patched.
• A WAF in front of the REST API. Batch requests are rare in normal traffic and can be rate limited or inspected.

Quick check

Sources

• WordPress 7.0.2 release announcement
• NVD: CVE-2026-60137
• CISA Known Exploited Vulnerabilities catalog