Critical WordPress vulnerability allows an unauthenticated attacker to execute code on the server

WordPress fixed a critical flaw in its core software that allows an attacker without an account to load a PHP file from outside a site’s theme folders. On some servers, this can lead to execution of attacker-controlled code. WordPress is telling site owners to update immediately.