Pre-Authentication RCE in WordPress Core

altairprime

Is there meant to be content at this URL? < HTTP/2 404 < date: Fri, 17 Jul 2026 23:18:29 GMT < content-length: 0

jerrythegerbil

“Pre-Authentication” and “Unauthenticated” are meaningfully different things, and for the purposes of marketing reach you always want to push for “Unauthenticated” if possible. Typically Pre-Authenticated means knowing some additional contextual information such as the userID or something like that is required for exploitation, but actual authentication is not required. The impact is limited by how easy it is to know that pre-authentication information, which remains unknown.