An unauthenticated SQL Injection vulnerability in WordPress Core allows attackers to extract sensitive database information by manipulating the authornotin…
Affected component: WordPress (core)
Fixed in: 6.8.6, 6.9.5, 7.0.2
Known exploited: this CVE is listed in the CISA Known Exploited Vulnerabilities catalog.
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 26, 2026. No PowerSEC firewall rule blocks this attack. Update to 6.8.6, 6.9.5 or 7.0.2 (or a later release on the same branch) to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-60137