Critical WordPress RCE vulnerability announced
A critical vulnerability has been discovered in WordPress 's get_page_template() function for page-template resolution that could allow remote-code execution (RCE) by an unauthenticated attacker, in some limited circumstances. The project has provided an update for the most recent branch of WordPress, as well as backports of the fix for branches back to 4.7 . See the vulnerability report for the…
We haven't written up this one. LWN has the full story — the link below goes straight to it.
