CVE-2026-60137

nvd.nist.gov • July 23, 2026

WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical RCE Vulnerability in BeyondTrust Remote Support and PRA A critical pre-authentication remote code execution vulnerability, CVE-2026-1731, has been identified in BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA). This vulnerability allows unauthenticated remote attackers to execute operating system commands by sending specially crafted requests. Users of these affected products are advised to take immediate action to mitigate the risk. 229 sources 30

Extracted Entities

CVE-2026-60137

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (1)

Platforms (1)