security1 publisher
WordPress 7.1.1 blocks a crafted link that makes an admin's browser install the attacker's theme
pwn.ai rated the forced theme install 7.1 on its own and 9.6 once chained through a theme's unauthenticated handler. The fix shipped on September 17 in a security release reaching branches back to 4.7.
Publishers:thehackernews.com
Reality
- Evidence60
- Adoption30
- Hype gap+12
- Incentives62
- Confidence58