AIKIDO-2026-362570

TL;DR

WP_Query builds the author__not_in SQL clause without forcing non-array values through an ID list sanitizer, so unsanitized input can be interpolated into a NOT IN (...) predicate. A plugin, theme, or request path that forwards attacker-controlled data into that parameter can therefore alter the query. The fix parses author__not_in with wp_parse_id_list so only integers are included in the SQL.