WordPress Releases Version 7.1.4 to Mitigate Security Vulnerabilities
WordPress unveiled version 7.1.4, which addresses a staggering 22 security vulnerabilities.
Notably, the update rectifies an unauthenticated remote code execution flaw that is currently being exploited by malicious actors.
It is imperative for administrators to ensure that this update is applied, rather than assuming that the automatic background updates have been executed successfully.
The official release documentation outlines the corrections, which include mitigations for stored cross-site scripting, information disclosure issues, authorization weaknesses, and denial-of-service attacks.
Of particular concern is a vulnerability linked to the Core upgrade process, which briefly exposes a window for attackers to execute PHP code without the necessary credentials.
WordPress Resolves Critical Security Issues
A recent advisory from Wordfence highlights that researcher Umut Bayram disclosed a remote code execution (RCE) vulnerability affecting WordPress versions 4.7 through 7.1.3.
This vulnerability holds a CVSS score of 8.1, underscoring its severe potential impact, albeit contingent upon certain exploitation conditions.
In installations utilizing complete Core packages for updates, vulnerable sites unpack files in predictable directories beneath wp-content/upgrade. Within these temporary files resides the WordPress installer.
If a server permits public access and allows PHP execution in that designated staging directory, attackers can potentially access the staged installer. This opens the door to server-side code execution.
Effectively exploiting this vulnerability obliges attackers to identify the staging directory and finalize their actions before any cleanup occurs.
Laboratory analyses have constrained this operational window to mere seconds, rendering continuous automated polling more effective than sporadic requests.
The update in WordPress version 7.1.4 introduces randomization of staging directories, an index guard, and blocks the insecure promotion of staged configuration data.
In contrast to previously cited WordPress path-traversal RCE vulnerabilities, this particular attack relies on temporary upgrade artifacts, deviating from the template-resolution method.
According to the Wordfence report, the initial exploit attempt was recorded by its firewall just nine minutes subsequent to the deployment of a protective rule.
During the first 21 hours post-release, over 18,500 requests were made targeting staged setup-config.php paths.
Two significant sources conducted repeated polling of select websites for approximately 14.5 hours. Their findings indicate ongoing exploitation efforts, although successful compromises have not been confirmed.
This surge in activity aligns with recent attacks targeting WordPress via malicious plugins, albeit employing a different entry method.
Wordfence Premium, Care, and Response subscribers were granted protections at 20:30 UTC on October 28, while free users are scheduled to receive the relevant rule on November 27.
Administrators are urged to verify the installation of version 7.1.4 via the Dashboard > Updates, or to implement the corresponding patched branch release. Security fixes extend back to WordPress 4.7, although only the latest version enjoys active support.
Wordfence users are encouraged to activate Extended Protection, as exploitation attempts can directly request PHP files without preloading WordPress.
It is prudent to review logs for any unanticipated PHP requests within the wp-content/upgrade directory, investigate unfamiliar administrator accounts, and scan for unauthorized files and plugins.
While firewall protection bolsters security measures, it does not substitute for core security updates, nor does it ascertain the integrity of previously compromised websites.
Source link: Gbhackers.com.
