Cybercriminals are currently attempting to exploit a critical unauthenticated remote code execution (RCE) vulnerability within WordPress Core, taking advantage of a narrow exposure window that appears during software updates.
A recent report from Wordfence indicates a staggering 58,693 blocked attack attempts within a mere 24-hour window, signifying almost 60,000 attempts to breach the platform, albeit without confirmed compromises.
On October 28, 2026, WordPress issued version 7.1.4, which rectifies 22 identified security vulnerabilities.
The significance of this update lies in the fact that attackers are not required to possess an account or interact with the system to initiate an exploit, though specific environmental and timing conditions must align to facilitate an attack.
Overview of the WordPress RCE Vulnerability
Designated as CVE-2026-119977, this vulnerability is rated with a CVSS score of 8.1 and is pertinent to WordPress versions spanning from 4.7 to 7.1.3.
The complexity of the attack is classified as high, primarily due to its reliance on restrictive timing conditions, rather than the severity of potential outcomes following a successful breach.
During comprehensive Core upgrades, vulnerable installations extract files into predictable directories located beneath wp-content/upgrade.
These temporary directories, housing installer components, may remain accessible via the website throughout the duration of the update process.
An unauthenticated adversary could engage with the staged setup-config.php file prior to its deletion, allowing for interaction with the temporary installation and the possibility of executing PHP code.
Successful exploitation necessitates the presence of installer files, publicly accessible staging paths, PHP execution within the directory structure, and sufficient time to carry out the attack.
Laboratory evaluations suggest that this window of opportunity lasts only for a matter of seconds. To counteract this brevity, attackers employ repeated polling methods, striving to access installer paths precisely as they become exposed during the update.
Wordfence noted its first firewall rule match a mere nine minutes post-deployment, with over 18,500 requests aimed at staged installer paths within the initial 21 hours.
Two predominant sources are reported to have probed small collections of websites for approximately 14.5 hours.
The corrective measures implemented include randomizing staging directories, adding an index guard, and preventing the insecure promotion of staged configuration data.
Furthermore, security fixes have been backported to older affected branches, notwithstanding that WordPress designates only its latest version as actively supported.
Wordfence rolled out its firewall rule at 20:30 UTC on October 28 for Premium, Care, and Response customers, with free users anticipated to receive the rule on November 27, adhering to the standard 30-day delay protocol.
The significance of Extended Protection lies in the fact that exploit requests may target staged PHP files without needing to load WordPress first.
Consequently, administrators are urged to ensure proper firewall optimization rather than relying solely on the mere implementation of the rule for adequate protection. Firewall filtering should never be a substitute for thorough patching.
Site administrators are encouraged to navigate to Dashboard > Updates to install WordPress version 7.1.4 or its corresponding patched branch release.
Additionally, they should monitor logs for any unexpected requests within wp-content/upgrade and examine for unfamiliar administrator accounts, unauthorized plugins, or suspicious PHP files.
Updating WordPress effectively mitigates the vulnerable behavior, while comprehensive scanning and robust firewall controls serve as supplementary remediation measures.
Nevertheless, it is crucial to note that neither a successfully executed update nor the statistics on blocked attacks can definitively assure that a previously vulnerable server remains uncompromised; thus, any suspicious findings warrant further investigation and a robust incident response.
Source link: Gbhackers.com.
