WordPress update fixes code-injection flaw as exploit attempts emerge
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
WordPress released updates on Wednesday, including 7.1.4 and backports to older branches, that close nearly two dozen security flaws. One core flaw, rated CVSS 8.1, lets unauthenticated attackers inject code via a predictable directory during an in-progress core update, and Wordfence has already recorded more than 18,500 probing requests.