A security flaw has been found in the core WordPress software used to run millions of websites. This flaw, called an interpretation conflict, could let bad actors perform SQL injection attacks on your site, and in some cases gain the ability to run unauthorized code on your WordPress installation.
This vulnerability can be chained with a separate known WordPress vulnerability, referenced as CVE-2026-60137, to increase the impact of possible attacks.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030
