An Update Process That Could Be Turned Against the Site
The most critical issue is a race condition in the way WordPress performs core upgrades, discovered by researcher Umut Bayram. While updating, WordPress unpacks files into the wp-content/upgrade/ directory. Because the temporary folder names were predictable and cleanup deleted the index.php file, an unpacked WordPress installer could sit exposed to the public web.
An attacker who got there at exactly the right time could run the installer against a database of their choosing, which creates a route to remote code execution and a complete site takeover.
The attacker does not need a WordPress account, but the opening lasts only a few seconds, which is why Patchstack considers real-world exploitation difficult. The fix appends 16 random characters to temporary folder names, brings back the index.php safeguard, and prevents wp-config.php from being copied out of the working directory.
Stored XSS in the Interactivity API, Blocks, and Customizer
Most of the other fixes address stored cross-site scripting, where malicious script is saved on a site and runs when someone else views the content. In the Interactivity API, users with Contributor access could store crafted attributes that slipped past content filtering and later triggered unsafe behavior in the browser. WordPress now blocks risky bindings, adds stronger validation, and resolves a denial-of-service problem that could lock up a visitor’s browser tab.
Further XSS fixes apply to crafted block markup, Customizer selective refresh, the Categories block, and navigation labels, and Image and Playlist handling has been hardened as well.
Since many of these issues require Contributor access or higher, sites that tightly control who holds those roles face a lower risk. The updater flaw is the exception, because it does not require an account.
Data Exposure and Permission Gaps
The update also closes several exposure and access problems. Unpublished Customizer changesets were viewable by logged-out visitors, and WordPress now stops users from reading notes attached to posts they are not allowed to edit.
Anthropic reported flaws tied to personal data removal requests and specially crafted usernames. The bundled root certificates were refreshed in response to the eMudhra revocation.
Flaws That Reach Back to WordPress 4.7
Some of these weaknesses have existed in core for years. Search Engine Journal points out that certain issues trace back to version 4.7, so WordPress has backported fixes to older branches, including 7.0.8, 6.9.11, and releases going back to 4.7.39.
Each branch contains only some of the 22 flaws, not all of them. Only the newest WordPress version is actively supported, and versions 4.6 and earlier receive no security patches.
Steps to Update and Secure Your Site
Administrators can install the update from the Dashboard under Updates or download it directly from WordPress.org. Sites with automatic background updates should receive it on their own, but it is worth checking the installed version rather than trusting that the process finished. Patchstack also advises blocking web access to wp-content/upgrade/ at the server level and auditing all accounts with Contributor privileges or higher.
A plugin-based firewall may not shield the extracted installer, because that copy runs independently of the plugin. WordPress 7.2 is due on December 8, but there is no reason to hold off on this update until then.
