Our automated tracking framework flagged that CISA added CVE-2026-63030 (WordPress Core) to the Known Exploited Vulnerabilities (KEV) catalog on July 24, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-63030 by July 24, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-63030 |
| Vendor / product | WordPress Core |
| Vulnerability | WordPress Core Interpretation Conflict Vulnerability |
| CVSS base score | 9.8 |
| Added to KEV | July 21, 2026 |
| Days public before listing (NVD → KEV lag) | 4 |
| Federal patch deadline | July 24, 2026 |
| Known ransomware use | No |
How This Compares to WordPress’s Track Record
This one was public for just 4 days before CISA confirmed exploitation — faster than WordPress’s 420-day median, meaning attackers moved unusually quickly. WordPress currently ranks #22 on our KEV Lag leaderboard.
| WordPress in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 5 |
| Median lag (public → KEV listing) | 420 days |
| 0-day rate (exploited at or before disclosure) | 0% |
| Entries tied to known ransomware campaigns | 0 |
For perspective, the median across all 1653 tracked KEV entries is 274 days — WordPress’s exploited vulnerabilities are flagged slower than the catalog average.
Other Recent WordPress KEV Additions
The most recent WordPress vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-60137 | Core | July 21, 2026 | 4 | No |
| CVE-2019-9978 | Social Warfare Plugin | November 3, 2021 | 955 | No |
| CVE-2020-25213 | File Manager Plugin | November 3, 2021 | 420 | No |
| CVE-2020-11738 | Snap Creek Duplicator Plugin | November 3, 2021 | 569 | No |
Defense guide: How to Detect SQL Injection: Attack Chain & Defense (2026) — detection signals, attack chain and response steps for this class of attack.
What This Means for Defenders
A critical vulnerability, CVE-2026-63030 affecting WordPress Core, has been added to CISA’s KEV catalog with a CVSS base score of 9.8. This indicates extreme urgency for all organizations utilizing WordPress. The federal patch deadline is exceptionally short, 2026-07-24, highlighting immediate, active exploitation. Given its high severity and KEV listing, all WordPress instances are highly exposed and should prioritize patching immediately to mitigate the risk of compromise. Organizations unable to meet the deadline must implement robust compensating controls, such as web application firewalls (WAFs) with virtual patching capabilities, enhanced monitoring for anomalous activity, and network segmentation to isolate affected systems.
The low NVD-to-KEV lag of just 4 days, combined with the federal patch deadline being only 3 days after the KEV listing, signals that widespread exploitation is already occurring. This minimal window between public disclosure and KEV cataloging suggests attackers were quick to weaponize the vulnerability, leaving little time for proactive defense. While ransomware use is not currently known, the rapid exploitation points to sophisticated threat actors targeting these systems.
WordPress’s historical median lag of 420 days for KEV entries, compared to this vulnerability’s 4-day lag, is a stark deviation. This indicates an unusually rapid and severe exploitation campaign for CVE-2026-63030. Security teams should treat this as an active threat with a compressed detection and response window, prioritizing patching above all else. Monitor all WordPress assets vigilantly for any signs of compromise, even after patching.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- SharePoint RCE Exploited; FortiBleed Linked to Ransomware
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
