This critical vulnerability in WordPress Core allows unauthenticated remote code execution and is currently being actively exploited in the wild.

The vulnerability is a remote file inclusion (CWE-98) flaw within the get_page_template() function. An unauthenticated attacker can force the application to include readable local PHP files located outside of the designated theme directories, which can result in full remote code execution.

The potential for unauthenticated remote code execution represents the highest level of security risk, allowing attackers to take full control of the web server. Given the CVSS score of 9.5 and evidence of active exploitation, this flaw poses an immediate threat to data integrity, system availability, and the confidentiality of all information hosted on the WordPress instance.

Immediate Action: Update the WordPress installation to version 7.1.2 or later immediately.

Proactive Monitoring: Review server access logs for anomalous requests targeting theme directories or attempts to include files with unusual paths.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block file inclusion attempts and directory traversal patterns in HTTP requests.

Public Exploit Available: Yes — multiple public proof-of-concept repositories exist on GitHub.

Given the critical nature of this vulnerability and confirmed active exploitation, organizations must prioritize patching their WordPress environments. Failure to update to version 7.1.2 significantly increases the risk of a full system compromise. Ensure that all staging and production instances are updated as part of an emergency deployment cycle.