Patch the exploited vulnerability in your CMS or application on WordPress
Why it matters
An advisory that covers your visible version is on CISA's list of vulnerabilities attackers are using in the wild, so unpatched sites are being hit. It may already be fixed, because hosts back-port fixes without changing the version number, but check it today.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Back up the site, then update WordPress core, all plugins and all themes from Dashboard, Updates, or with WP-CLI. If the CVE is in a plugin or theme, update or remove that one first and read its changelog for the fixed version.
- Check the integrity of the files. Run wp core verify-checksums and wp plugin verify-checksums --all to compare them with the official copies (the plugin check only covers plugins from wordpress.org, not premium or custom ones), and list the administrator accounts with wp user list --role=administrator to spot anyone you do not know.
- If anything looks wrong, restore a known good backup, change all passwords, update the keys and salts in wp-config.php, and ask your host or a security specialist for help.
bash
wp core update wp plugin update --all wp theme update --all wp core verify-checksums wp plugin verify-checksums --all wp user list --role=administrator
Related
Scan your domain to see whether this applies to you.