CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
Actively exploited. At least one CVE in this advisory is listed in the CISA Known Exploited Vulnerabilities catalog — exploitation has been observed in the wild. Treat remediation as urgent.
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
CSIRTS triage
- What
- WordPress Core has an interpretation conflict vulnerability that could allow SQL injection and remote code execution.
- Who is affected
- All installations of WordPress are affected.
- Urgency
- Remediation is critical due to active exploitation and the potential for remote code execution.
- Action
- Update WordPress to the latest version.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch WordPress Core
Get an email when a new WordPress Core advisory drops — max one per day, one-click unsubscribe.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-63030
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Exploitation confirmedCVE-2026-63030Already exploited in the wild (CISA KEV) — the prediction phase is over. Patch now. Riskier than 100% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-63030 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- critical[NEW] [critical] WordPress: Multiple vulnerabilities allow code executioncert-bund
- unknownexploitedWordPress security advisory (AV26-723) - Update 1cccs
- highexploitedCISA Adds Four Known Exploited Vulnerabilities to Catalogcisa
- unknownWordPress Multiple Vulnerabilitieshkcert
- unknownexploitedMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-alerte
- unknownMultiple vulnerabilities in WordPress (July 20, 2026)cert-fr-avis
- unknownNCSC-2026-0250 [1.00] [H/M] Vulnerabilities fixed in WordPress by Automatticncsc-nl
- criticalexploitedCVE-2026-63030: WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint r…nvd
More from CISA Known Exploited Vulnerabilities
- criticalCVE-2026-20316: Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability2026-07-29
- criticalCVE-2025-68686: Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability2026-07-27
- criticalCVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability2026-07-27
- criticalCVE-2026-50522: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-07-22
- criticalCVE-2026-16232: Check Point SmartConsole Improper Authentication Vulnerability2026-07-22