WPCoreCMS is a customized fork of ClassicPress designed with security, performance, and simplicity as its primary goals. It features a modified directory structure, enhanced page and object caching, and removes many commonly exploited features, including plugin installation, script management, and other unnecessary administrative capabilities.
The administrative interface has been streamlined to provide a cleaner, more intuitive experience and can be customized to match each user’s specific role and workflow. By eliminating unnecessary administrative functions and restricting access to advanced configuration options, WPCoreCMS significantly reduces the attack surface while providing a faster, more secure, and easier-to-manage content management system.
Latest Version: 2.9
Released January 2026
2.9 Security Patch:
• Fixed - GhostLock vulnerability (CVE-2026-43499)
• A facilitated SQL injection issue reported as a team by TF1T, dtro, and haongo
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution reported by Adam Kues at Assetnote / Searchlight Cyber
2.8+ Security Patch:
• Fixed - WordPress Remote Code Execution vulnerability (CVE-2026-63030).
2.6+ through 2.7+ Security Patchs - ClassicPress Imports:
• A Blind SSRF issue reported by sibwtf, and subsequently by several other researchers while the fix was being worked on
• A regex DoS weakness in numeric character references reported by Dennis Snell of the WordPress Security Team
• A stored XSS in nav menus reported by Phill Savage
• An AJAX query-attachments authorization bypass reported by Vitaly Simonovich
• A stored XSS via the data-wp-bind directive reported by kaminuma
• An XSS that allows overridding client-side templates in the admin area reported by Asaf Mozes
• A PclZip path traversal issue reported independently by Francesco Carlucci
• An XXE in the external getID3 library reported by Youssef Achtatal
