WordPress — свободно распространяемая система управления содержимым сайта с открытым исходным кодом.
Релизный цикл, информация об уязвимостях
График релизов
Количество 1 928
CVE-2026-119977
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
CVE-2026-119977
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 ...
CVE-2026-119977
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
GHSA-p6jj-qrp3-7m4g
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window.
BDU:2026-18207
Уязвимость веб-интерфейса ядра системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-templa ...
CVE-2026-87902
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
BDU:2026-15200
Уязвимость функции get_page_template() ядра системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано 1 | |
|---|---|---|---|---|
 | CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | CVSS3: 8.1 | 1% Низкий | 8 дней назад |
| CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 ... | CVSS3: 8.1 | 1% Низкий | 8 дней назад |
 | CVE-2026-119977 WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | CVSS3: 8.1 | 1% Низкий | 8 дней назад |
| GHSA-p6jj-qrp3-7m4g WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package core upgrades. This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window. | CVSS3: 8.1 | 1% Низкий | 8 дней назад |
 | BDU:2026-18207 Уязвимость веб-интерфейса ядра системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.1 | 1% Низкий | 12 дней назад |
| CVE-2026-87902 An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | CVSS3: 8.1 | 96% Критический | около 2 месяцев назад |
| CVE-2026-87902 An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | CVSS3: 8.1 | 96% Критический | около 2 месяцев назад |
| CVE-2026-87902 An unauthenticated attacker can make `get_page_template()` page-templa ... | CVSS3: 8.1 | 96% Критический | около 2 месяцев назад |
 | CVE-2026-87902 An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | CVSS3: 8.1 | 96% Критический | около 2 месяцев назад |
| BDU:2026-15200 Уязвимость функции get_page_template() ядра системы управления содержимым сайта WordPress, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.1 | 96% Критический | около 2 месяцев назад |
Уязвимостей на страницу