Fresh WordPress Vulnerability in Attackers’ Crosshairs

A high-severity unauthenticated race condition vulnerability in WordPress's Core update process allows remote code execution. The flaw arises from predictable, web-accessible staging directories during updates, enabling attackers to exploit a narrow time window while WordPress unpacks updates. WordPress 7.1.4 and earlier branches have been patched to randomize staging directories and prevent unsafe configuration promotion. Exploitation attempts began shortly after patch release, but no successful compromises have been reported.

• securityweek.com/fresh-wordpress-vulnerability-in-attackers-crosshairs/ (opens in a new tab)

• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-830: Apple Safari jsToWasm IC Entrypoint Type Confusion Remote Code Execution VulnerabilityHighVulnerability2026-10-28