Posts tagged: WordPress

A timing flaw in WordPress Core lets an unauthenticated attacker over HTTP grab files from a predictable staging path mid-upgrade and get code running on the server, no login needed.

An unauthenticated attacker can trick WordPress’s page-template lookup into loading a readable PHP file from outside the active theme, potentially leading to remote code execution on the server.