Critical RCE Vulnerability in WordPress Core Exploited in the Wild

Searchlight Cyber has identified a pre-authentication remote code execution (RCE) vulnerability in WordPress Core, affecting over 500 million websites. The flaw can be exploited by anonymous users on stock installations without plugins. Public proof-of-concept exploits are circulating, prompting security firm watchTowr to report early signs of exploitation in the wild. Site owners are urged to update to WordPress versions 7.0.2 or 6.9.5 immediately to mitigate risks. Temporary measures include blocking anonymous access to the batch API, though these may impact legitimate site use. The vulnerability is critical due to its potential for widespread exploitation. Technical details are withheld to give defenders time to patch their systems. The situation is evolving, and ongoing monitoring is advised.

Key Points: • A critical RCE vulnerability in WordPress Core affects over 500 million sites. • Public exploits are circulating, leading to active exploitation in the wild. • Immediate updates to WordPress versions 7.0.2 or 6.9.5 are strongly recommended.