CVE-2026-60137

This CVE reveals a critical gap between abstract severity metrics and operational reality. The core tension: CVSS 5.9 (Medium) contradicts CISA KEV inclusion and an EPSS score of 0.79029 — the latter placing this in the 99th percentile for exploitation probability. The discussion converges on the view that CVSS base scores fail to capture post-deployment dynamics, particularly for vulnerabilities already under active exploitation. The most analytically valuable insight concerns the vulnerability's indirect architecture. This is not a direct injection in WordPress core; it requires a plugin or theme to pass untrusted input into the `author__not_in` parameter of WP_Query. This creates a two-stage remediation problem: patching WordPress core removes the vulnerable parameter, but exploitation persists if any plugin or theme continues coupling untrusted input to it. The patch deployment paradox is acute — high urgency signals (KEV + EPSS) demand immediate action, but the actual remediation requires audit-and-patch cycles that cannot be rushed without breaking functionality. The historical pattern analysis (historyrhyme) provides crucial context: SQL injection in WP_Query parameters has appeared at least four times in the past decade, following the same conditional chain pattern. This suggests the problem is structural to WordPress's design philosophy — core leaves parameters with incomplete input handling and expects plugins/themes to compensate, despite inconsistent security knowledge across the ecosystem. Key points of tension: faultmemory pushes back on treating EPSS as directly applicable to organizational prioritization, arguing it measures aggregate probability across the WordPress ecosystem rather than conditional probability given specific asset inventory. fossil raises the uncomfortable question of whether the exploitation window already passed before patch release — making core patching partly theater while the actual plugin chains may persist. For defenders, the implications are clear: treat this as a two-track remediation requiring both core update AND code-pattern audit; assume other WP_Query parameters may share the same incomplete handling; and recognize that the detection problem is not "do I have this CVE" but "does any code on this site couple untrusted input to this parameter" — a question most operators cannot answer at scale.

Reviewed through automated stages and approved by a human before publication.