A critical vulnerability with RCE possibility has been discovered in WordPress

Developers of WordPress have officially confirmed the presence of a critical vulnerability affecting all versions of the system released since 2016. The problem is classified as critical with a rating of 9.2 points on the CVSS scale.

The path traversal type vulnerability allows an unauthorized attacker to access the server's file system. In certain environment configurations, this leads to the execution of arbitrary code (RCE), which gives full control over the compromised site. The attack vector does not require administrator credentials.

The project's security team has already released the corresponding patches. All owners of sites on this platform are recommended to immediately update the system core to the current version. A detailed analysis of the technical attack vector and recommendations for protecting infrastructure are available in the official project repository.

This security breach is considered one of the most serious in recent years due to the long period of existence of the vulnerable code. Cybersecurity experts note that automated scanners have already begun searching for unprotected instances, so installing updates is a priority task for administrators.