{"resultsPerPage":11,"startIndex":0,"totalResults":11,"format":"NVD_CVEHistory","version":"2.0","timestamp":"2026-11-08T00:13:09.003","cveChanges":[{"change":{"cveId":"CVE-2026-60137","eventName":"New CVE Received","cveChangeId":"AE9F8CC0-476D-4795-A5C9-BD7F8422DC0B","sourceIdentifier":"contact@wpscan.com","created":"2026-07-17T20:17:27.790","details":[{"action":"Added","type":"Description","newValue":"WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in parameter of WP_Query, which could allow SQL Injection when a plugin or theme passes untrusted input to the parameter."},{"action":"Added","type":"Affected","newValue":"New affected value received.  <a href=\"https:\/\/github.com\/CVEProject\/cvelistV5\/blob\/main\/cves\/2026\/60xxx\/CVE-2026-60137.json\">CVE-2026-60137<\/a>"},{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-fpp7-x2x2-2mjf"},{"action":"Added","type":"Reference","newValue":"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/"}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"5C23ABBA-F800-4EE2-85F7-D2BC97AD3DB1","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-07-17T20:17:27.790","details":[{"action":"Added","type":"CVSS V3.1","newValue":"AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N"},{"action":"Added","type":"CWE","newValue":"CWE-89"},{"action":"Added","type":"SSVC","newValue":{"timestamp":"2026-07-17T19:51:44.616319Z","id":"CVE-2026-60137","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"732132EC-DA91-4BCB-A5AE-EF48E2BE1A69","sourceIdentifier":"contact@wpscan.com","created":"2026-07-18T05:16:54.427","details":[{"action":"Added","type":"CVSS V3.1","newValue":"AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:N\/A:N"}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE CISA KEV Update","cveChangeId":"8162253D-4C8B-494B-89B8-224B02349DD7","sourceIdentifier":"9119a7d8-5eab-497f-8521-727c672e3725","created":"2026-07-21T16:00:00.343","details":[{"action":"Added","type":"Date Added","newValue":"2026-07-21"},{"action":"Added","type":"Due Date","newValue":"2026-07-21"},{"action":"Added","type":"Required Action","newValue":"2026-07-21"},{"action":"Added","type":"Vulnerability Name","newValue":"2026-07-21"}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"3B63C8EB-24AB-4C86-A623-834C92930E36","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-07-21T16:17:19.240","details":[{"action":"Added","type":"Reference","newValue":"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"},{"action":"Changed","type":"SSVC","oldValue":{"timestamp":"2026-07-17T19:51:44.616319Z","id":"CVE-2026-60137","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"},"newValue":{"timestamp":"2026-07-21T15:45:09.401257Z","id":"CVE-2026-60137","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"Initial Analysis","cveChangeId":"C7235459-F257-4F64-B68B-4E9DF17681ED","sourceIdentifier":"nvd@nist.gov","created":"2026-07-21T19:23:22.253","details":[{"action":"Added","type":"CPE Configuration","newValue":"OR\n          *cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* versions from (including) 6.9 up to (excluding) 6.9.5\n          *cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (excluding) 7.0.2\n          *cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* versions from (including) 6.8 up to (excluding) 6.8.6"},{"action":"Added","type":"Reference Type","newValue":"WPScan: https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-fpp7-x2x2-2mjf Types: Vendor Advisory"},{"action":"Added","type":"Reference Type","newValue":"WPScan: https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/ Types: Release Notes"},{"action":"Added","type":"Reference Type","newValue":"CISA-ADP: https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 Types: US Government Resource"}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"BBDAACC2-6537-4EB0-BA80-53A9AEF41B94","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-07-22T05:17:11.750","details":[{"action":"Changed","type":"SSVC","oldValue":{"timestamp":"2026-07-21T15:45:09.401257Z","id":"CVE-2026-60137","options":[{"exploitation":"active"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"},"newValue":{"timestamp":"2026-07-21T00:00:00+00:00","id":"CVE-2026-60137","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"49FE1F2B-2C75-4F5A-B5DF-78F29261E70F","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-07-29T20:17:06.270","details":[{"action":"Changed","type":"SSVC","oldValue":{"timestamp":"2026-07-21T00:00:00+00:00","id":"CVE-2026-60137","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"},"newValue":{"timestamp":"2026-07-22T03:55:47.898130Z","id":"CVE-2026-60137","options":[{"exploitation":"active"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"A5EF147B-56B7-47A1-ABEE-A76B14A72BBC","sourceIdentifier":"contact@wpscan.com","created":"2026-10-07T19:17:39.560","details":[{"action":"Added","type":"Reference","newValue":"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-fpp7-x2x2-2mjf"},{"action":"Added","type":"Reference","newValue":"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-fpp7-x2x2-2mjf"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/"},{"action":"Removed","type":"Reference Type","oldValue":"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-fpp7-x2x2-2mjf Types: Vendor Advisory"},{"action":"Removed","type":"Reference Type","oldValue":"https:\/\/wordpress.org\/news\/2026\/07\/wordpress-7-0-2-release\/ Types: Release Notes"}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"CVE Modified","cveChangeId":"EB1D99E8-62AA-4681-B9EE-43B0697EA8EC","sourceIdentifier":"134c704f-9b21-4f2e-91b3-4a467353bcc0","created":"2026-10-07T19:17:39.560","details":[{"action":"Removed","type":"CVSS V3.1","oldValue":"AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:N"},{"action":"Added","type":"Reference","newValue":"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"},{"action":"Removed","type":"Reference","oldValue":"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137"},{"action":"Removed","type":"Reference Type","oldValue":"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-60137 Types: US Government Resource"}]}},{"change":{"cveId":"CVE-2026-60137","eventName":"Modified Analysis","cveChangeId":"98E4C72C-9020-41B1-9609-9B1412BD2E9E","sourceIdentifier":"nvd@nist.gov","created":"2026-10-08T10:35:47.777","details":[]}}]}