The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an alert regarding an actively exploited SQL injection vulnerability within WordPress Core, a flaw that could enable malicious actors to compromise websites and potentially execute remote code.
Identified as CVE-2026-63030, this vulnerability was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on July 21, 2026.
This designation signifies that it has been confirmed as actively exploited in the wild, presenting an urgent threat to establishments that utilize WordPress.
The vulnerability stems from an interpretation conflict in WordPress Core, categorized under CWE-436. Such a flaw engenders inconsistencies in input processing, facilitating the injection and execution of malevolent SQL queries.
Exploiting this vulnerability allows attackers to manipulate backend database queries, potentially leading to the exposure of sensitive information or the alteration of application behavior.
WordPress Core SQL Injection Vulnerability Exploited
Researchers caution that CVE-2026-63030, also referenced as wp2shell, becomes markedly more perilous when combined with CVE-2026-60137, another SQL injection flaw categorized under CWE-89.
This flaw is prevalent when plugins or themes inappropriately handle untrusted user inputs in database queries without adequate sanitization.
While SQL injection vulnerabilities are commonly attributed to insecure coding practices within extensions, this specific instance is particularly critical as it impacts default WordPress installations when exploited alongside the core flaw.
The combination of these vulnerabilities may empower unauthenticated attackers to escalate from mere SQL injection to complete remote code execution.
This escalation implies that threat actors could seize full control of infected WordPress sites, circumventing the need for valid credentials.
Such access may be exploited to deploy web shells, inject malicious scripts, redirect users to phishing sites, or employ compromised servers for further attacks.
Although CISA has not ascertained whether these vulnerabilities are actively involved in ransomware campaigns, it emphasizes that active exploitation has already been observed.
As WordPress underpins a considerable portion of the internet, the potential attack surface is vast, rendering this vulnerability particularly enticing to both opportunistic and sophisticated threat actors.
CISA has mandated that federal agencies resolve CVE-2026-63030 by July 24, 2026, and CVE-2026-60137 by August 4, 2026, as part of Binding Operational Directive (BOD) 26-04.
This directive underlines the necessity for prompt patching based on associated risks and obligates organizations to act swiftly in securing vulnerable systems.
The agency also advocates adherence to its Forensic Triage Requirements to discern possible compromises and evaluate the impact of exploitation.
WordPress administrators and security personnel are strongly advised to implement vendor-supplied patches as soon as they are available.
In instances where mitigations are yet unreleased, organizations should assess their exposure, restrict access to vital systems, and contemplate temporarily disabling vulnerable components.
Monitoring database queries, web server logs, and unusual administrative activities can aid in identifying signs of exploitation.
This incident underscores the persistent danger posed by core application vulnerabilities, compounded by insecure plugin or theme behavior.
It accentuates the importance of employing comprehensive security strategies, including rigorous input validation, web application firewalls, and ongoing vulnerability management.
With confirmed active exploitation, the WordPress ecosystem finds itself at a critical juncture of security.
Organizations that delay remediation expose themselves to the risk of complete site compromise, data breaches, and potentially catastrophic downstream attacks that could impact users and customers.
Source link: Cybersecuritynews.com.
