WordPress Patches Critical 9.2 RCE Flaw

WordPress 7.1.2 fixes a 9.2 severity path traversal flaw present since 2016, backported to version 4.7. Unauthenticated attackers can include a local.php file via get_page_template, leading to remote code execution if themes like Twenty Twelve, Twenty Fourteen, Neve, Hestia or Sydney have a page- directory and pearcmd.php is readable. Exploitation began under five hours after the patch, with traffic rising tenfold.