CISA says a WordPress core flaw is being exploited. Update to 7.1.4
The bug lets an unauthenticated attacker run code on the server during the window when WordPress updates itself
2 stories for “CVE”
The bug lets an unauthenticated attacker run code on the server during the window when WordPress updates itself
The flaw, CVE-2026-112816, scored 10 out of 10 and lets an attacker impersonate an authorized client without a private key. Canonical, the company behind Ubuntu, has released a fix.