Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

Support
1

Since WP is providing security patches back to WP4.7, I assume this vulnerability affects ClassicPress?

https://www.wordfence.com/blog/2026/09/psa-critical-unauthenticated-path-traversal-vulnerability-patched-in-wordpress-core/

2

tagging @timkaye here but I would strongly advise to sensibly report such concerns in private to the core team next time. I think today during the core team meeting those concerns can be raised too.

3

We’ll be releasing a security update very soon, just as we did after the other recent WP security updates.

4

Version 2.7.3 has now been released and addresses this issue (among others).