WordPress patched a critical vulnerability on September 22, 2024, that permits unauthenticated attackers to load and execute arbitrary PHP files on vulnerable installations. The flaw affects WordPress core and impacts multiple version branches, including legacy systems still running WordPress 4.7 and newer.
The vulnerability allows an attacker without any account access to force a WordPress site to load a PHP file from outside the intended theme directories. On certain server configurations, this escalates to remote code execution (RCE), giving attackers the ability to run malicious commands with the permissions of the web server process. This represents a severe risk because WordPress powers over 43 percent of all websites using a content management system.
WordPress released patches across all actively maintained branches. The fix shipped in WordPress 6.7.2, along with security updates for versions 6.6.3, 6.5.5, and earlier branches stretching back to 4.7. Site administrators running unsupported versions below 4.7 receive no patch and remain vulnerable.
The attack vector requires no authentication, meaning a threat actor can target any WordPress site without credentials or prior compromise. Exploitation becomes trivial once a working payload is identified. Organizations relying on default WordPress installations face immediate risk. Servers with permissive file permissions, certain PHP configurations, or unprotected upload directories amplify the danger considerably.
The window between disclosure and widespread patching creates a critical exposure period. Site owners who delay updates or operate environments where centralized patching proves difficult remain targets. Automated scanning and exploitation tools typically emerge within days of a high-profile WordPress vulnerability publication.
Site administrators should prioritize updates immediately. WordPress.org recommends checking the automatic update settings in the WordPress admin dashboard. Most modern WordPress installations enable automatic updates by default, but many organizations disable this feature for stability reasons, leaving manual patching as the only option. Hosts and managed WordPress platforms should deploy patches rapidly across their customer base.
Network defenders should monitor for exploitation attempts. Common indicators include unusual file access patterns, unexpected PHP execution in non-theme directories, web server log entries showing requests to non-standard paths, and sudden spikes in server resource consumption. Intrusion detection systems capable of monitoring HTTP traffic can flag attempts to access files outside expected WordPress directories.
Organizations managing WordPress at scale should implement layered defenses. Web application firewalls (WAFs) can detect and block requests attempting to exploit the file loading mechanism. Proper server hardening, including restrictive file permissions, disabling unnecessary PHP execution in upload directories, and running WordPress with minimal required privileges, reduces impact.
The patch availability across all supported versions demonstrates WordPress's commitment to long-term security support. However, the real-world deployment challenge remains steep. Statistics show that approximately 25 percent of all WordPress installations run outdated versions. Organizations with legacy systems on branches nearing end-of-life must accelerate their patching schedules or face compounding risk.
Verification that patches installed correctly should follow deployment. Site administrators can check their WordPress version in the admin dashboard settings. Testing critical functionality after patching confirms that the update did not introduce site-breaking changes.