A security flaw has been identified in the core WordPress software that powers millions of websites. This is a SQL injection vulnerability: SQL is the system WordPress uses to store and retrieve site data like posts, comments, and user account information, and this flaw could let attackers sneak harmful commands into that system to manipulate or access your site's data.
This issue triggers when a plugin or theme installed on your site passes unscreened, untrusted user input to the affected core parameter. If this flaw is chained with the previously identified WordPress security issue tracked as CVE-2026-63030, an attacker who does not need any login credentials for your site could gain full control of a standard default WordPress installation, including the ability to run their own unauthorized code on your site's server.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-60137
