🔥 This vulnerability is being actively exploited in the wild (CISA Known Exploited Vulnerabilities catalog)
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
Summary
WordPress Core has an interpretation conflict vulnerability that allows attackers to perform SQL injection (a type of attack where malicious database commands are inserted into input fields) and achieve remote code execution (running unauthorized commands on a server). This flaw can be combined with another vulnerability (CVE-2026-60137) to cause additional damage, and it is currently being actively exploited by attackers.
Solution / Mitigation
Apply mitigations according to vendor (WordPress) instructions while following CISA's BOD 26-04 guidance for prioritizing security updates based on risk. For cloud services, follow applicable BOD 26-04 guidance or discontinue use of the product if mitigations are unavailable. Stakeholders must evaluate each asset's internet exposure and ensure adherence to BOD 26-04 patching guidelines. The due date for applying these mitigations is 2026-07-24. See the WordPress 7.0.2 release notes at https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ for specific patch details.
Vulnerability Details
EPSS: 8.9%
Yes
🔥 Actively Exploited
July 20, 2026
Classification
Taxonomy References
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-63030
First tracked: July 21, 2026 at 02:01 PM
Classified by LLM (prompt v3) · confidence: 95%