Comment by pseudosavant
4 hours ago
Seems like most main company sites at places I've worked. If you are lucky, that WP instance is a fully managed service where they proactively deal with keeping it on the latest PHP, WordPress, and plug-in versions.
We run on SiteGround, and they had the patch up about an hour or so after it dropped and auto upgraded us.
My shit on Wolfi, managed by ChainGuard, a “security company”, didn’t have a patch live hours later.
The funny thing is, people running Wordpress have dealt with 0 day bullshit so often that it’s basically a Tuesday for them, not even a big deal. So hilariously Wordpress folks have plenty of options here simply because it’s been a nasty attack vector for so long and these people are so used to dealing with horrific vulns like this that patching it is actually pretty trivial