WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack
Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.
Stories per day · 30 days
2 RSS
4 stories, newest first · one card per story
Stories tagged #wordpress-core
WordPress: Unauthenticated path traversal leading to conditional RCE
WordPress advisory discloses an unauthenticated path traversal in core that can lead to conditional remote code execution.
Click2Shell: WordPress Flaw Enables RCE Chain
SOCRadar describes Click2Shell, a WordPress Core flaw that can chain a tricked admin browser into RCE.
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.
7