A security flaw has been identified in WordPress Core, the base software that powers all sites built on the WordPress platform. This issue, classified as an interpretation conflict, creates a potential entry point for attackers to target sites running affected versions of WordPress.
If successfully exploited, this vulnerability can be used to carry out SQL injection attacks, a technique that lets bad actors access, edit, or delete data stored in your site’s database, and can even lead to remote code execution, meaning attackers could run unauthorized programs or take partial control of your site. The flaw can also be chained with another existing WordPress security issue, CVE-2026-60137, to expand the range of potential harm.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030