Two security vulnerabilities in WordPress can be chained to execute arbitrary code on the web server without any valid login. That combination makes the flaws particularly dangerous, because an attacker does not need an account on the target system.
Already Being Exploited
Reports indicate that attackers are actively exploiting these vulnerabilities in the wild. Anyone running WordPress should update to the latest version immediately and check whether the system has already been compromised. Common indicators include modified PHP files, newly created administrator accounts, or unfamiliar scheduled tasks.
What You Should Do Now
Apply available security updates without delay. Review file permissions, installed plugins, and any unusual file changes on your server. Plugins and themes that are no longer maintained should be removed or replaced with actively supported alternatives. FameSystems recommends configuring WordPress to apply security updates automatically, so gaps like this do not stay open for long.