CVE entry · CVE-2026-63030
CVE-2026-63030: WordPress Core Interpretation Conflict Vulnerability
WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.
- Actively exploited: added to CISA’s KEV catalog on July 21, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: July 24, 2026.
- CERT-FR alert CERTFR-2026-ALE-007 of July 20, 2026.
Description from CISA’s KEV catalog.
CERT-FR alerts and notices
-
CERTFR-2026-ALE-007Multiples vulnérabilités dans WordPress (20 juillet 2026)
What to do
- Check whether your estate includes WordPress Core, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.