Escalating Threat: WordPress Core Vulnerability Under Siege
Hackers are aggressively exploiting a remote code execution vulnerability within the WordPress Core, posing significant risks to websites during critical software updates.
According to a recent threat intelligence report from Wordfence, over 60,471 attack attempts were thwarted in just a 24-hour span.
It is important to note that these figures represent attempts rather than confirmed breaches, leaving the actual number of targeted sites unknown.
On October 28, 2026, WordPress issued version 7.1.4, a vital update that rectifies 22 identified security flaws.
This update specifically mitigates the aforementioned code execution vulnerability while also addressing issues related to stored cross-site scripting, information disclosure, and permission mishaps.
The WordPress team has implored site administrators to implement this update without delay, acknowledging researcher Umut Bayram for uncovering the critical upgrade flaw.
Understanding the WordPress RCE Vulnerability
The vulnerability at hand is characterized by a race condition, whereby an attacker must exploit a momentary opportunity during the installation process.
In contrast to vulnerabilities that necessitate compromised credentials or accounts, this particular flaw can be targeted without any login authentication.
Nonetheless, the successful exploitation hinges on conducive circumstances present during a comprehensive WordPress Core upgrade.
During this update process, WordPress temporarily extracts files into a staging directory. With predictable folder names and accessible installation files, a separate WordPress installer may become exposed.
If an attacker gains access to this installer, they could connect it to a database under their control, thereby creating a vector for executing malicious code on the server.
As noted in previous coverage by Cybersecuritynews.com regarding the WordPress 7.1.4 update, the patch introduces 16 random alphanumeric characters to temporary folder names, reinstates protective handling of index.php, and prevents the copying of wp-config.php from the active directory.
These modifications target the vulnerability within the staging process rather than addressing flaws in third-party plugins.
The window of opportunity for exploitation is often brief, typically lasting mere seconds, which complicates successful attacks.
However, repeated probing attempts afford assailants additional chances to intercept a site during its exposure.
Despite the inherent timing constraints, Wordfence has documented instances of exploitation attempts occurring post-release, indicating that attackers are actively seeking to take advantage of this vulnerability.
Cybersecuritynews.com has elaborated on the nature of active exploitation endeavors within the WordPress ecosystem.
It is crucial to distinguish between requests intercepted by firewalls and successful instances of code execution.
A substantial number of blocked requests reflects attack activity, yet it does not substantiate that adversaries gained access to an equally large number of sites.
According to the Wordfence advisory, Premium, Care, and Response customers were provided with a new firewall rule on October 28, approximately three hours following the release.
In contrast, free users are slated to receive this protective measure on November 27, adhering to the standard 30-day waiting period. Administrators should not defer patching their sites while awaiting additional security provisions.
Updating WordPress and Ensuring Security Compliance
Website proprietors are advised to navigate to the Dashboard, select Updates, and verify the installation of WordPress version 7.1.4.
For those utilizing outdated branches, the appropriate security releases must be applied. The official version documentation enumerates patched versions, including 7.0.8, 6.9.11, and pertinent backports through 4.7.39. Notably, WordPress versions 4.6 and earlier are no longer eligible for security updates.
While automatic background updates are designed to deploy the latest version to supported configurations, it is incumbent upon administrators to confirm that the process has been completed successfully rather than presuming their sites are secure.
The documentation unequivocally states that only the current iteration of WordPress commands active support. Fixes for older branches serve as a transition strategy rather than justification for delaying critical maintenance.
As an added layer of security, administrators may want to restrict public web access to the wp-content/upgrade/ directory.
Relying solely on a plugin firewall may not adequately protect the extracted installer, which operates separately from the primary site.
Ultimately, promptly applying the Core security update remains the paramount solution for safeguarding against this vulnerability during the upgrade sequence.
Source link: Cybersecuritynews.com.
