AIKIDO-2026-708703
roots/wordpress is vulnerable to SQL Injection
78
High Risk
This Affects:
roots/wordpressTL;DR
WP_Query builds the author__not_in SQL clause without forcing non-array values through an ID list sanitizer, so unsanitized input can be interpolated into a NOT IN (...) predicate. A plugin, theme, or request path that forwards attacker-controlled data into that parameter can therefore alter the query. The fix parses author__not_in with wp_parse_id_list so only integers are included in the SQL.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and a plugin, theme, or request path passes attacker-controlled input into WP_Query's author__not_in parameter.
Background info
roots/wordpress is vulnerable to SQL Injection in versions 6.8.0 - 6.8.5, 6.9.0 - 6.9.4 and 7.0 - 7.0.1.
How to fix this
Upgrade the roots/wordpress library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.