Is CVE-2026-63030 in the CISA Known Exploited Vulnerabilities catalog?

Yes — CVE-2026-63030 is listed in CISA KEV, remediation due 2026-07-24.

Which frameworks does CVE-2026-63030 affect?

CVE-2026-63030 affects WordPress.

CISA Known Exploited Vulnerability

CVE-2026-63030

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-202

⚠ Actively exploited (CISA KEV) WordPress 2026

CISA catalog entry

Product

Core

Vendor

WordPress

Added to KEV

2026-07-21

Remediation due

2026-07-24

What WebPulse reported · 1 analysis

A WordPress RCE That Skips the Plugin Layer Entirely

Two chained CVEs enable pre-authenticated code execution on standard WordPress installs. Patches shipped July 17 — sites that haven't applied them are exposed.

July 22, 2026

View CVE-2026-63030 on the NIST National Vulnerability Database →

Related vulnerabilities

CVE-2026-8732 CVE-2026-8206 CVE-2026-8181 CVE-2026-60137 CVE-2026-41940 CVE-2026-4020 CVE-2026-3844 CVE-2026-3300