WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

WordPress has patched a critical vulnerability in its core software that allows an attacker without an account to load a PHP file from outside the theme folders. This flaw can potentially enable code execution on certain servers. The patch was released on September 22 as part of WordPress 7.1.2, and also includes fixes for older supported branches, dating back to version 4.7. WordPress is notifying site owners about the fix. The vulnerability can be exploited by an attacker with no account, making it a significant security concern. The patch is available for all supported versions of WordPress.