WordPress Core 4.7.0 — 7.1.2 - Conditional Action Hook Injection via Unregistered Post Status or Post Type

Overview

Advisory ID

d27c2393-64b2-4087-aa91-cbfaec644e13

Product

WordPress wordpress

Affected

≤7.1.2

Fixed in

4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3

Weakness

CWE-20 Improper Input Validation

Required access

Unknown

Published

Oct 7, 2026 · updated Nov 13, 2026

Credit

Alex Concha

WordPress Core is vulnerable to conditional action hook injection in versions 4.7 through 7.1.2 because wp_transition_post_status() constructs status- and post-type-specific action names without first verifying that the supplied status and post type are registered. This makes it possible for attackers who have a separate method of introducing an unregistered status or post type into a post transition to collide with an existing action name and invoke a site-specific callback in an unintended context.

Not sure which version you run? Run a passive check — it reads public files only.

Remediation & mitigations

1. Update to one of the following versions, or a newer patched version: 4.7.38, 4.8.33, 4.9.34, 5.0.30, 5.1.27, 5.2.29, 5.3.26, 5.4.24, 5.5.23, 5.6.22, 5.7.20, 5.8.18, 5.9.19, 6.0.17, 6.1.15, 6.2.14, 6.3.13, 6.4.13, 6.5.13, 6.6.10, 6.7.10, 6.8.11, 6.9.10, 7.0.7, 7.1.3
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.