There is a newly identified security flaw in WordPress Core, the base software that powers the vast majority of WordPress websites. Referred to as an interpretation conflict vulnerability, this flaw affects unpatched versions of the WordPress platform. If exploited by a bad actor, the flaw could enable two high-risk attacks: SQL injection, which lets attackers access, modify, or delete data stored on your site (including customer information, published content, and login credentials), and remote code execution, which lets attackers run unauthorized commands on the server hosting your site to take control of its core functions. This vulnerability can also be chained with the separate WordPress security flaw CVE-2026-60137 to increase the impact of potential attacks.
Source: CISA Known Exploited Vulnerabilities Catalog — https://nvd.nist.gov/vuln/detail/CVE-2026-63030