WordPress has published a core security advisory for an unauthenticated path traversal bug that can lead to remote code execution.
The advisory, GHSA-7hp8-65ch-5whp, was filed against the wordpress-develop repository on GitHub. It describes a flaw that lets an attacker who isn't logged in reach files outside the folder the application intends to expose. Under certain server conditions, that traversal can be escalated into remote code execution, which is why the advisory's own title calls it "conditional." The bug lives in WordPress core itself, not in a third-party plugin or theme.
That distinction is the story here. Most WordPress security bulletins come out of the plugin and theme ecosystem, where a flaw only affects the sites that installed the vulnerable extension. A core-level bug is different: it potentially touches every WordPress install running the affected code, no plugin choices required.
Core advisories are rarer than plugin ones precisely because WordPress's core codebase gets far more scrutiny. That rarity is exactly why this one is worth watching rather than filing away as routine patch-Tuesday noise.