A security flaw has been identified in the core WordPress software, the base platform that powers all standard WordPress websites. This issue, called an interpretation conflict vulnerability, could be exploited by bad actors to perform SQL injection attacks (injecting harmful commands into your site's database) and achieve remote code execution (running unauthorized programs on your site's server).
This vulnerability can also be chained with a separate known WordPress flaw, CVE-2026-60137, to make attacks more effective. The issue exists in the core WordPress platform itself, rather than in separate plugins, themes, or custom code added to your site.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030