WordPress alert widens version scope, not exposure certainty
On Aug. 14, 2026, CSIRT Italia expanded its WordPress alert to list affected releases from 4.7.0 through 7.0.3. The agency describes a high-severity remote code execution flaw that could let an authenticated remote attacker run arbitrary code if exploited.
The alert says listed releases are vulnerable only under specific circumstances documented in the corresponding WordPress security bulletins; it does not describe those conditions. The version range identifies where to assess, not which sites are confirmed exposed.
For teams inventorying sites across these branches, a version-only scan can overcount affected installations. The update adds scope, but the referenced bulletins still determine which installations are actually vulnerable.