A security flaw has been found in the core WordPress software, the platform that powers most websites hosted on our service. This issue, called an interpretation conflict vulnerability, could let a malicious actor use a method called SQL injection to access or change data in your site’s database, and in some cases take full remote control of your website’s server.
This specific flaw can be chained with another known WordPress security vulnerability (CVE-2026-60137) to make these attacks easier to carry out.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030
