WordPress has released version 7.1.2 to address a critical security vulnerability that allows unauthenticated attackers to load arbitrary PHP files from outside the theme folders. On certain server configurations, this flaw can be leveraged to achieve full remote code execution. The update patches all supported branches back to version 4.7 and has been added to CISA's Known Exploited Vulnerabilities catalog.

What should defenders do?

Update WordPress to version 7.1.2 or later immediately. WordPress has released fixes for all supported branches back to version 4.7. Enable automatic updates or manually update via the WordPress dashboard. Monitor for any suspicious file activity or unexpected PHP file execution outside of designated directories.

criticalVulnerability

WordPress Patches Critical Vulnerability Allowing Unauthenticated Remote Code Execution

Flaw in Core Enables Loading External PHP Files, Affecting Millions of Sites Globally

CyberIntel DeskPublished 6 days agoUpdated less than a minute ago1 min read

WordPress Patches Critical Vulnerability Allowing Unauthenticated Remote Code Execution

Key Takeaways

WordPress 7.1.2 released on September 22, 2026, patches a critical core vulnerability.
The flaw allows unauthenticated attackers to load arbitrary PHP files from outside theme folders.
On certain server configurations, the flaw can lead to remote code execution (RCE).
The vulnerability affects all supported WordPress branches back to version 4.7.

Related Security News

highVulnerability

Official MCP Python SDK Flaw Can Let Malicious Servers Steal OAuth Credentials

The maintainers of the official MCP Python SDK disclosed a security vulnerability that could allow a malicious server to trick applications into divulging OAuth credentials. The issue affects the handling of client secrets, authorization codes, and PKCE proof keys when communicating with token endpoints.

The Hacker Newsabout 4 hours ago1 min read

highCVE

CISA Adds Two Citrix NetScaler Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. CVE-2026-88771 involves improper input validation and CVE-2026-88772 involves improper restriction of operations within the bounds of a memory buffer, both affecting Citrix NetScaler products. The additions trigger remediation requirements under Binding Operational Directive 26-04 for Federal Civilian Executive Branch agencies.

CISA Advisoriesabout 5 hours ago2 min read