WordPress releases emergency patch for unauthenticated file‑inclusion vulnerability

WordPress announced on September 22 that it has released an emergency update to close a critical flaw in its core code that could allow an unauthenticated attacker to load a PHP file from outside a site’s theme directory.

The vulnerability, classified as a file‑inclusion issue, permits a malicious actor to supply a path to a remote or local PHP script. On hosting environments where PHP’s “allow_url_include” directive is enabled—or where the server permits execution of files outside the designated theme folder—this can escalate to arbitrary code execution, giving the attacker full control over the compromised site.

WordPress powers roughly 40 percent of all websites on the internet, making any weakness in its software a high‑value target for cyber‑criminals. The platform’s open‑source nature means that the core code is publicly available, which aids both legitimate developers and potential attackers in scrutinising the software for security gaps.

Security researchers first reported the issue to the WordPress security team earlier this month. After confirming the flaw, the team prepared a patch that was bundled into the routine September security release. Site owners are urged to update immediately, as the vulnerability does not require a valid user account or any form of authentication to be exploited.

Experts note that the risk is amplified on shared‑hosting setups where multiple WordPress sites run under the same PHP configuration. In such scenarios, an exploit on one site could potentially affect other sites on the same server if the same insecure PHP settings are in place. Administrators are advised to verify that “allow_url_include” is disabled and that file‑system permissions restrict access to theme directories.

WordPress’s rapid response underscores its ongoing commitment to security, but the episode also serves as a reminder that regular updates are essential for all users. The project’s security team continues to monitor for related threats and encourages developers to follow best practices such as using security‑focused plugins, implementing a web‑application firewall, and maintaining up‑to‑date backups.