Critical WordPress RCE flaw: update without delay
Translated by a model; the original is in Russian.
A critical vulnerability has surfaced in WordPress that, under certain limited conditions, allows an unauthenticated attacker to achieve remote code execution (RCE). The issue lies in the get_page_template() function, which handles page-template resolution.
The project has already released an update for the most recent WordPress branch and prepared backports of the fix for older branches, going all the way back to version 4.7. The exact conditions that make an attack succeed are laid out in a separate vulnerability report; the phrase "in some limited circumstances" suggests that exploitation requires a combination of factors rather than leaving every site exposed by default.
The flaw also affects ClassicPress, a WordPress fork that LWN covered in 2024. As of publication, no security update has been provided for that project, leaving its users in a more exposed position.
Operators of sites running either content-management system are advised to apply the updates as soon as possible.
Source: LWN.net
Comments
Sign in, to comment.