Filtered by tag: patch × Clear
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
Matched: WordPress
WordPress released version 7.1.2 on September 22, 2026, patching a critical unauthenticated path traversal vulnerability (CVE-2026-87902) in Core. Security backports were issued for all branches back to 4.7. The flaw lets attackers include arbitrary local PHP files outside the theme directory, potentially enabling remote code execution on sites using themes with a page- subdirectory and accessible PHP files like pearcmd.php. Wordfence Premium users received firewall protection immediately; free users get it October 22.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Matched: WordPress
WordPress patched a critical vulnerability in its core software that allows unauthenticated attackers to force a site to load a PHP file from outside its theme folders, potentially enabling remote code execution on some servers. The fix was released September 22 in WordPress 6.7.2 and backported to all supported branches dating to version 4.7. Site owners are urged to update immediately.
WordPress Patches ‘Click2Shell’ Vulnerability
Matched: WordPress
WordPress has patched a vulnerability dubbed "Click2Shell" that allows attackers to automatically install and preview themes on a target site. The flaw could ultimately lead to remote code execution. WordPress has released a patch and users are advised to update their installations promptly to mitigate potential exploitation risks.
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Matched: WordPress
installs a theme, but chained with other vulnerabilities it can lead to remote code execution. The flaw affects logged-in administrators who click a malicious link, triggering an unintended theme installation via the WordPress.org directory. WordPress has released patches addressing this and related issues, and users are urged to update immediately.
Two major security flaws are affecting more than six million WordPress websites
Matched: WordPress
Wordfence has disclosed two critical vulnerabilities in popular WordPress plugins Elementor Pro and Super Forms, putting over six million websites at risk. Both flaws allow unauthenticated attackers to upload executable files, enabling remote code execution. Tracked as CVE-2026-32475 and CVE-2026-14894, each carries a 9.8/10 severity score. Both have been patched, but exploitation attempts have already exceeded 440,000 combined. Users are urged to update immediately.