Affected Systems
WordPress Core versions 7.1.0 and earlier. Fixed in version 7.1.1 released last week. Affects all WordPress installations running vulnerable versions where administrators can be socially engineered to click malicious links.
Exploitation Status
Proof-of-concept exploit publicly available. Full technical details published by pwn.ai researcher Paulos Yibelo. Exploitation requires social engineering (phishing) to trick logged-in administrator into visiting crafted URL. No reports of active exploitation in the wild yet.
Business Impact
Pre-authenticated remote code execution chain allows attackers to force-install WordPress themes and execute arbitrary PHP on the server. Successful exploitation enables file modification/deletion, access to wp-config.php (database credentials, auth secrets), user data theft, rogue admin account creation, and malicious script injection. Attack vector requires administrator interaction (clicking malicious link), reducing immediate risk but increasing exposure via phishing or existing XSS vulnerabilities. Public PoC significantly increases exploitation likelihood.
Urgency
🟠Within 24 hours
Recommended Actions
- Update all WordPress installations to version 7.1.1 immediately to patch the Core CSRF vulnerability
- If immediate patching is not possible, enable DISALLOW_FILE_MODS in wp-config.php to prevent forced theme/plugin installation
- Implement security awareness training for WordPress administrators about phishing risks and verifying URLs before clicking
- Review WordPress access logs for unusual theme installation activity or Customizer preview requests from August 22 onward
- Deploy web application firewall (WAF) rules to detect and block suspicious theme preview requests with malformed parameters