Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since July 21, 2026.
CVE-2026-63030
WordPress Core Interpretation Conflict Vulnerability
Added to KEV July 21, 2026
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2026-63030
- CWE
- CWE-436
- Affected products
- Core · WordPress Core · WordPress
What happened
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
What it means for your business
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-63030). WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137. CISA remediation due date: 2026-07-24. If you need help checking exposure, call (864) 335-9223.
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA due date: July 24, 2026
Sources
Related briefs
WordPress WordPress Core Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability
WordPress WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-119977). WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades. CISA remediation due date: 2026-11-06. If you need help checking exposure, call (864) 335-9223.
WordPress Core Remote File Inclusion Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-87902). WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. CISA remediation due date: 2026-09-28. If you need help checking exposure, call (864) 335-9223.
WordPress Core SQL Injection Vulnerability
WordPress Core is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-60137). WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA remediation due date: 2026-08-04. If you need help checking exposure, call (864) 335-9223.
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.