Vulnerabilities · 90 days ago
On Aug. 14, 2026, CSIRT Italia expanded its WordPress alert to list affected releases from 4.7.0 through 7.0.3. The agency describes a high-severity remote code execution flaw that could let an authenticated remote attacker run arbitrary code if exploited.
The alert says listed releases are vulnerable only under specific circumstances documented in the corresponding WordPress security bulletins; it does not describe those conditions. The version range identifies where to assess, not which sites are confirmed exposed.
For teams inventorying sites across these branches, a version-only scan can overcount affected installations. The update adds scope, but the referenced bulletins still determine which installations are actually vulnerable.
6 sources covering this story
Sanata vulnerabilità in WordPress
Sanata una vulnerabilità con gravità “alta” in WordPress.
WordPress 7.0.4 Patches Remote Code Execution Vulnerability
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files.
Subida de archivos sin restricciones en WordPress
WordPress ha publicado 1 vulnerabilidad de severidad alta que, en caso de ser explotada, podría permit
WordPress Plugins Compromised Without a Single File Change
Poisoned JSON feed let attackers backdoor WordPress sites without changing any plugin files
Vulnerability in Magnolia CMS software
Stored Cross-Site Scripting vulnerability (CVE-2026-18478) has been found in Magnolia CMS software.
WordPress: PoC pubblico per lo sfruttamento della CVE-2026-64638
Disponibile un Proof of Concept (PoC) per la vulnerabilità identificata dalla CVE-2026-64638, già sanata dal vendor, che interessa il noto CMS WordPress.
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under specific conditions.
Múltiples vulnerabilidades en WordPress
WordPress ha publicado 1 vulnerabilidad, de severidad alta, cuya explotación podría permitir a un atac
Part of the PlainSec briefing for 2026-08-08