Facilitated SQL injection vulnerability in the author__not_in parameter of WP_Query

WordPress versions 6.8 and higher are vulnerable to an SQL injection issue.



In WordPress versions 6.9 and higher, this combined with a REST API batch-route confusion issue (GHSA-ff9f-jf42-662q) leads to Remote Code Execution.

This vulnerability affects the following application versions:

• WordPress 6.8



• WordPress 6.8.1



• WordPress 6.8.2



• WordPress 6.8.3



• WordPress 6.8.4



• WordPress 6.8.5



• WordPress 6.9



• WordPress 6.9.1



• WordPress 6.9.2



• WordPress 6.9.3



• WordPress 6.9.4



• WordPress 7.0



• WordPress 7.0.1