WordPress Core: remote code execution flaw (no CVE assigned)
A remote code execution vulnerability in WordPress Core has been reported with a CVSS score of 8.1. According to the source, exploitation attempts began shortly after patches were released, with nearly 63,000 attack attempts in 24 hours.
Checked in Shield: no
Who is affected
WordPress Core versions 4.7 through 7.1.3 are affected. No CVE identifier has been assigned to this flaw.
How to check
In the admin panel open Dashboard → Updates, or run wp core version in WP-CLI, and compare your version with the current release on wordpress.org.
How to fix
Patches were released in October. Update WordPress to the latest available version. The source does not name the fixed version, so confirm it on the official WordPress site.
What Shield checks not checked
Checked in Shield: no. This is usually not visible from outside, or the check has not been added yet; we collect such cases and add checks in batches.
Good to know
The fixed version number and technical details are not disclosed yet; source: The Hacker News.
