WordPress core, the foundational software that powers all standard WordPress websites, has a security flaw called an interpretation conflict vulnerability. This flaw stems from a mismatch in how the software processes certain types of input, which malicious actors can take advantage of.
If exploited, this vulnerability could allow attackers to carry out SQL injection attacks, which let them access, alter, or steal data stored in your site’s database, including customer details, published content, and user login credentials. It can also enable remote code execution, giving attackers the ability to run unauthorized, potentially harmful code directly on your website, letting them take control of site features or spread malicious software to your visitors.
This vulnerability can also be chained with the separate known WordPress vulnerability CVE-2026-60137 to increase the severity and impact of potential attacks.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030