WordPress
3 articles with this tag
CVE-2026-87902 — Unauthenticated file inclusion in WordPress core (conditional RCE): explainer and fix
Unauthenticated local file inclusion in WordPress core 4.7–7.1.1 (CWE-98), leading to RCE when theme and server conditions line up. Fixed 22 September (7.1.2 and every branch back to 4.7); CISA added it to KEV on 25 September. This site's view: an EPSS of 3% does not matter once it is in KEV. Update, and also turn off PHP's register_argc_argv to cut the server-side half of the chain.
CVE-2026-63030 / CVE-2026-60137 — Unauthenticated SQLi to RCE in WordPress core (explainer & fixes)
A REST API batch-endpoint route-confusion flaw in WordPress core (CVE-2026-63030, CWE-436) chains with the WP_Query author__not_in SQL injection (CVE-2026-60137, CWE-89) to reach unauthenticated SQLi → RCE (CVSS 9.8, in CISA KEV). Both are fixed in the same release. The real fix is updating core to 6.8.6 / 6.9.5 / 7.0.2, plus a compromise check. WordPress is core software with an enormous install base, so updating is the top priority.
WordPress security — a production hardening reference
WordPress has the largest share, so it's the biggest target — but the entry points are predictable (plugin/theme vulnerabilities, skipped updates, weak admins, exposed admin panels). This is a working reference: (1) a priority-ordered hardening checklist (P0–P2), (2) per-area guidance — automatic updates, minimizing plugins/themes, strong admin + 2FA, reducing admin exposure (xmlrpc/REST enumeration/file editing), wp-config and secrets, file permissions, HTTPS/backups, PHP/dependency freshness, and (3) a self-verification checklist. Defensive only — no attack steps.