CVE-2026-63030

UNKNOWNKnown Exploited

CISA Known Exploited Vulnerability

https://wordpress.org/news/2026/07/wordpress-7-0-2-release/ ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-63030

Remediation deadline: July 24, 2026

Description

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Timeline

Published:July 21st, 2026 12:00 AM

Last modified:July 21st, 2026 12:00 AM

Added to KEV:July 21st, 2026

CVSS Scoring

No CVSS v3 score available

Affected Software

From NVD CPE configuration data

Vendors

WordPress

Products

Core

Weaknesses (CWE)

CWE-436

References & Reports

Advisories, patches, and third-party reports

No references available.

Source: CISA KEV + NVD · Data may lag official sources by up to one minute