All vulnerabilities

WordPress core

GHSA-5qf7-2r5p-ppj8

Specially crafted URLs can automatically install and preview an inactive theme from WordPress.org

Severity: Medium 5.3
Published: 18 Sept 2026
Last changed: 18 Sept 2026
Added to UpHeron: 17 Oct 2026
Fixed in: 6.5.11, 6.6.8, 6.7.8, 6.8.9, 6.9.8, 7.0.5
Sources: WordPress

Affected software

Software Affected versions

WordPressWordPress core · cpe:a:wordpress:wordpress

Version 7.1.0
From 7.0.0 before 7.0.5
From 6.9.0 before 6.9.8
From 6.8.0 before 6.8.9

All 24 release lines

From 4.8.0 before 4.8.31
From 4.9.0 before 4.9.32
From 5.0.0 before 5.0.28
From 5.1.0 before 5.1.25
From 5.2.0 before 5.2.27
From 5.3.0 before 5.3.24
From 5.4.0 before 5.4.22
From 5.5.0 before 5.5.21
From 5.6.0 before 5.6.20
From 5.7.0 before 5.7.18
From 5.8.0 before 5.8.16
From 5.9.0 before 5.9.17
From 6.0.0 before 6.0.15
From 6.1.0 before 6.1.13
From 6.2.0 before 6.2.12
From 6.3.0 before 6.3.11
From 6.4.0 before 6.4.11
From 6.5.0 before 6.5.11
From 6.6.0 before 6.6.8
From 6.7.0 before 6.7.8
From 6.8.0 before 6.8.9
From 6.9.0 before 6.9.8
From 7.0.0 before 7.0.5
Version 7.1.0

References

GitHub Advisory Database https://github.com/advisories/GHSA-5qf7-2r5p-ppj8
WordPress security advisory https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-5qf7-2r5p-ppj8