Pre-Authentication RCE in WordPress Core

“Pre-Authentication” and “Unauthenticated” are meaningfully different things, and for the purposes of marketing reach you always want to push for “Unauthenticated” if possible.

Typically Pre-Authenticated means knowing some additional contextual information such as the userID or something like that is required for exploitation, but actual authentication is not required. The impact is limited by how easy it is to know that pre-authentication information, which remains unknown.

Is there meant to be content at this URL?

  < HTTP/2 404 
  < date: Fri, 17 Jul 2026 23:18:29 GMT
  < content-length: 0