A security flaw called an interpretation conflict has been identified in WordPress core, the base software that powers all standard WordPress websites. This vulnerability creates a risk that attackers could exploit it to perform SQL injection, a type of attack that lets bad actors access, alter or delete data stored in your site’s database. In some cases, this flaw could also be used to run unauthorized, harmful code directly on your website. This flaw can be chained with a separate, previously disclosed WordPress security issue (CVE-2026-60137) to carry out more sophisticated attacks.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030