WordPress WP_Query author exclusion can permit SQL injection
Affected WordPress core releases do not safely handle author__not_in when untrusted input reaches WP_Query. The flaw becomes directly exploitable when a plugin, theme, or REST route forwards attacker-controlled values into that argument, and it is one half of the critical remote-code-execution chain tracked separately as CVE-2026-63030.
- Component
- WordPress
- Plugin slug
Core- Affected
- 6.8.0 to < 6.8.6, 6.9.0 to < 6.9.5, 7.0.0 to < 7.0.2
- Safe version
6.8.6, 6.9.5, 7.0.2- Published
- Jul 17, 2026
This CVE was published Jul 17, 2026 and is one of 45 known issues for WordPress core.
Patch or disable the affected component.
Update WordPress 6.8.x to 6.8.6 or later, 6.9.x to 6.9.5 or later, and 7.0.x to 7.0.2 or later. The rule below is broad temporary containment for requests carrying author__not_in and may block legitimate integrations that expose that query feature.
Technical description
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N