WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
| Vendor | Product | Versions |
|---|---|---|
| wordpress foundation | wordpress | 4.7.0, 4.8.0, 4.9.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.5.0, 5.6.0, 5.7.0, 5.8.0, 5.9.0, 6.0.0, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.5.0, 6.6.0, 6.7.0, 6.8.0, 6.9.0, 7.0.0, 7.1.0, 7.1.1, 7.1.2, 7.1.3 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| open source | wordpress | cert_advisory | 90% |
Loading…
Updated affected versions to include 7.1.1, 7.1.2, and 7.1.3, added patch version 7.1.4, and confirmed active exploitation via CISA KEV database listing.
Severity upgraded from HIGH to CRITICAL, CVSS estimate updated to 9.0, and added CWE-94 (Code Injection) which better reflects the vulnerability mechanism.
Initial creation
