WordPress Patches Critical Core Flaw Enabling Remote Code Execution

WordPress fixed a critical core flaw that lets an unauthenticated attacker make a site load a PHP file from outside its theme folder. On some server configurations that can escalate to full remote code execution.

The fix shipped September 22 in WordPress 7.1.2, with patches backported to every branch the project still supports, back to 4.7. WordPress is telling site owners to update right away.