Attackers target fresh WordPress core update flaw hours after patch
Original title: Fresh WordPress Vulnerability in Attackers’ Crosshairs
The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.
Defiant and Wordfence say attackers began probing a high-severity WordPress race condition within hours of the October 28 fix in WordPress 7.1.4. During a full core update, files land in a predictable web-accessible staging path, and an unauthenticated attacker who hits that short window can reach remote code execution. Attack complexity is high. WordPress now randomizes the staging directory and backported the fix through the 4.7 branch. No CVE is assigned.
Unconfirmed: Wordfence reports active exploitation attempts but has not reported successful compromises.
- Wordfence recorded more than 18,500 requests in the first 21 hours.
- The first new firewall-rule match arrived nine minutes after deployment.
- Wordfence has not reported successful compromises.
- WordPress 7.1.4 also includes patches for 22 security defects.
- Fixes were backported to branches through WordPress 4.7.
Impact: Unauthenticated remote code execution during core updates
| Product | Affected | Fixed in |
|---|---|---|
| WordPress | — | WordPress 7.1.4 and backports through WordPress 4.7 |
- 1.Update to WordPress 7.1.4 or the backported fix on branches through WordPress 4.7.
- Vendors
- WordPress
From the original article
2 min read at securityweek.com
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution. The post Fresh WordPress Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.