EUVD-2026-45279Severity by source
Sources disagree (Medium–Critical)AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network SQLi (PR:N) but requires a non-default vulnerable plugin/theme path so AC:H; enables data extraction (C:H) with limited write in a SELECT context (I:L), no availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: WPScan
Lifecycle Timeline
8DescriptionCVE.org
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
Articles & Coverage 4
AnalysisAI
SQL injection in WordPress core (6.8.x before 6.8.6, 6.9.x before 6.9.5, 7.0.x before 7.0.2) arises from improper sanitisation of the author__not_in parameter in WP_Query, allowing an attacker to inject SQL when a plugin or theme forwards untrusted input into that parameter. Reported by WPScan and rated CVSS 9.1, it can lead to full database disclosure on affected sites, but exploitation is not reachable through unmodified core alone - a vulnerable plugin or theme code path is required. No public exploit identified at time of analysis and it is not listed in CISA KEV, though CISA SSVC flags the technical impact as total and the flaw as automatable.
Technical ContextAI
The vulnerability is a classic CWE-89 SQL injection in WP_Query, the central database query abstraction used throughout WordPress core, plugins, and themes to retrieve posts. The author__not_in argument is intended to accept an array of author IDs to exclude and is normally cast to integers before being folded into the generated SQL WHERE clause; in the affected builds this value is not properly sanitised, so a string containing SQL metacharacters is concatenated into the query. Because WP_Query queries execute against the wp_posts/wp_users schema via the shared $wpdb connection, a successful injection runs with the database privileges the WordPress site itself holds. The single affected CPE is cpe:2.3:a:wordpress:wordpress (all versions wildcard in the feed), with the concrete affected ranges enumerated by ENISA EUVD (EUVD-2026-45279).
RemediationAI
Vendor-released patch: upgrade WordPress core to 6.8.6, 6.9.5, or 7.0.2 depending on your branch, as described in the WordPress 7.0.2 release announcement (https://wordpress.org/news/2026/07/wordpress-7-0-2-release/) and advisory GHSA-fpp7-x2x2-2mjf; sites with automatic minor-version updates enabled will typically receive the fix without action. Where immediate core patching is not possible, audit plugins and themes for any code that passes user-controlled data into WP_Query's author__not_in argument and cast those values to integers (for example wrapping input in array_map('intval', ...)) before the query, since this closes the specific injection path at the cost of a small code change. As a compensating control, a WAF rule that inspects request parameters for SQL metacharacters reaching author-exclusion query strings can reduce exposure, though it risks false positives and will not catch every plugin-specific parameter name; restricting or disabling untrusted plugins/themes that expose raw query arguments is the more reliable interim measure.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today