WordPress publishes security update with multiple fixes
- Status
- Corroborated, not yet confirmed by the vendor
- Kind
- Vulnerability
- Vendor
- WordPress
- Product
- WordPress core
- First seen
Summary
WordPress has released a security update that includes a number of fixes, according to a post by Catalin Cimpanu. The item does not name the specific vulnerabilities or CVE identifiers, so their severity is unconfirmed.
If you use WordPress
Update WordPress core to the latest security release
Review the official WordPress release notes for the list of fixes
Update installed plugins and themes, which are often the source of exploitable issues
Update WordPress core and all plugins and themes to the latest versions
Review sites for unexpected admin users, files, or scheduled tasks
Restrict access to wp-admin and limit exposure of the site until patched
What the sources say 4
· Catalin Cimpanu on Bluesky: “WordPress has a security update out with a bunch of fixes” Source
· Mastodon: “A critical WordPress Core vulnerability is exploited in the wild.” Source
· SecurityWeek: “Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.” Source
· The Hacker News: “Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.” Source