type: cve · created: 2026-10-13 · updated: 2026-10-13 · tags: [cve] · confidence: medium · severity: critical · affected_sectors: [global] · au_impact: false
Tracked as CVE-2026-85097 (CVSS 10.0), it allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress sites, achieving remote code execution.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-85097 |
| CVSS | 9.8 (CRITICAL) |
| Vendor / product | Not stated |
| Reported | 2026-10-13 |