Act
active
CISA adds WordPress RCE flaw to KEV as actively exploited
- Engineer — Act: CISA KEV listing confirms active exploitation of this high-severity WordPress RCE; patch WordPress core to the latest released version immediately and verify no post-exploitation artifacts (unexpected admin accounts, modified files) on hosted instances.
- SOC/IR — Act: Active exploitation confirmed by CISA KEV; hunt for unusual POST requests and PHP execution anomalies on WordPress-hosted web servers since the patch release date, and check EDR/WAF telemetry for signs of webshell drops or lateral movement originating from web tiers.
- Leader — Plan: A CISA-flagged actively exploited RCE warrants confirming this week that your engineering teams have inventoried all WordPress deployments (including third-party-hosted marketing/landing pages) and are treating patching as urgent — not routine next-cycle work.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.