CVSS 8.1 (HIGH) · Actively exploited (listed in CISA KEV)
WordPress Core versions 4.7 through 7.1.3 contain a critical Remote Code Execution vulnerability. Unauthenticated attackers can exploit predictable staging paths during full-package core upgrades to execute arbitrary code on the server.
Successful exploitation allows attackers to gain full control over the web server, leading to complete compromise of confidentiality, integrity, and availability.
Immediately upgrade WordPress to version 7.1.4 or later to patch the vulnerability. Ensure all sites are updated promptly to mitigate the risk of active exploitation.
WordPress Core 4.7 至 7.1.3 版本存在嚴重的遠端程式碼執行漏洞。未經授權的攻擊者可利用核心升級期間可預測的暫存路徑，在伺服器上執行任意程式碼。
請立即將 WordPress 升級至 7.1.4 或更高版本以修復此漏洞。確保所有網站及時更新，以降低被積極利用的風險。