A security flaw has been identified in WordPress Core, the base software that powers WordPress websites. This is an interpretation conflict vulnerability that could be exploited by attackers to carry out SQL injection attacks and gain remote control of your website. SQL injection attacks let bad actors access, modify, or delete data stored in your site’s database, including customer information, published content, and user account details. This vulnerability can also be chained with another existing WordPress security issue (CVE-2026-60137) to increase the risk and potential impact of an attack.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030