WordPress Patches Two Core Flaws, Including Critical SQL Injection Vulnerability
Vulnerability Disclosure · 8 sources · Updated 2d ago · First seen Jul 19, 2026
WordPress released security updates addressing two Core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, according to an EG-FinCIRT advisory. The flaws carry reported CVSS scores of 9.8 and 5.9, respectively. The advisory associates them with SQL injection that may lead to remote code execution and describes both as remotely accessible without authentication or user interaction, though their attack complexity differs.
EG-FinCIRT reports that proof-of-concept exploits have been publicly disclosed, increasing the urgency of remediation, but does not establish active exploitation. Organizations operating WordPress sites should prioritize testing and deploying the security updates, particularly given the critical severity reported for CVE-2026-63030.
