A security vulnerability has been identified in the core WordPress software that powers a large number of websites. This flaw, called an interpretation conflict, could allow an attacker to perform SQL injection attacks that let them access, modify, or delete your website's stored data, and even execute their own unauthorized code on your website's server.
This vulnerability can also be chained with a separate, existing security flaw (tracked as CVE-2026-60137) to amplify its potential impact.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030
