WordPress patches an unauthenticated RCE back to branch 4.7
Victoria Shinder1 min readA critical vulnerability in WordPress's get_page_template() function, used for page-template resolution, can allow remote code execution by an unauthenticated attacker under a limited set of conditions, LWN reported on 23 September 2026. WordPress has published an update for the current branch and backported the fix to branches going back to 4.7. The conditions required for a successful attack are set out in the vulnerability report.
The same flaw affects ClassicPress, the fork of WordPress, and no security update has been issued there. Users of either system are advised to update soon.
What it means
The backport range is the part worth pausing on. Shipping a fix to every branch back to 4.7 is a statement about the installed base: the project knows that sites are still running releases from years ago and that telling them to upgrade first would leave them exploitable in the meantime. It is expensive maintenance, and it is the kind that never appears in a feature list.
ClassicPress illustrates the other half of that arithmetic. A fork inherits the code and therefore the defect, but it does not inherit the people who patch it, and the gap between the two disclosures is the window. If you run a fork of anything, the question to answer before you need it is who ships the security branch and how fast they have done it before.