WordPress Core: critical unauthenticated path traversal patch

WordPress has released a security update for a critical unauthenticated path traversal vulnerability in WordPress Core. Wordfence reported this in an advisory published on 22 September 2026. The flaw affects WordPress site and server administrators: it must be corrected immediately, without waiting for the next maintenance window.

What the advisory says

According to Wordfence, the vulnerability allows local file inclusion (LFI) via PHP without requiring authentication: an attacker does not need credentials to exploit it. On specific server configurations and themes, the exploit can escalate to remote code execution (RCE), that is, arbitrary code execution on the server hosting the site.

Wordfence does not specify in the advisory which exact combinations of server and theme expose the RCE risk, nor the assigned CVE number: the published text is a PSA (public service announcement) that directs users to apply the update as a priority action, not a detailed technical bulletin.

What to do

Anyone managing WordPress hosting, whether for themselves or clients, must:

• verify the version of WordPress Core installed on each site;
• apply the security update as soon as it is available in the admin panel or via wp core update;
• check server logs for anomalous access to file paths in the days before the patch, especially on sites with outdated themes or permissive PHP configurations (e.g. allow_url_include enabled).

For those administering multiple installations, it is worth automating version checking with centralised management tools (WP-CLI across multiple hosts, site management plugins, or version control via the hosting panel), so you don't depend on manually updating each individual site.

The full technical details, including any CVE, are in the original Wordfence advisory linked at the top of this article.