SQL injection in WordPress core WP_Query author__not_in parameter (CVE-2026-60137)

WordPress core does not properly sanitise the `author__not_in` parameter of `WP_Query`; when a plugin or theme passes untrusted input to this parameter as a string rather than an array, the type-check is bypassed and the raw value is dropped directly into the SQL query. When chained with CVE-2026-63030, a REST API batch-route confusion flaw present from WordPress 6.9 onward, the vulnerability enables unauthenticated remote code execution on default installations with no preconditions. Public POC available. Affected versions: - 6.8.0 through 6.8.5 - 6.9.0 through 6.9.4 - 7.0.0 through 7.0.1 We recommend updating to: 6.8.6, 6.9.5, 7.0.2. CVSS 5.9 · our assessment: this_month Reference: https://thehackernews.com/2026/07/new-wp2shell-wordpress-core-flaw-lets.html Details: https://vuln.today/cve/CVE-2026-60137