A security vulnerability has been found in the core WordPress software used to run millions of websites. This flaw, called an interpretation conflict, could allow bad actors to carry out SQL injection attacks, which let them access, change, or delete data stored on your site (such as customer information, published posts, or user account details). In some cases, this type of flaw may also let attackers run unauthorized, harmful code on your website.
This vulnerability can be chained with a separate known WordPress security issue (CVE-2026-60137) to expand the potential impact of attacks. The source advisory does not specify whether website owners or hosting providers need to take immediate action at this time.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030
