Significant Surge in Exploit Attempts Targeting WordPress Vulnerability
Cybercriminals launched over 240,000 attempts to exploit a critical vulnerability within the WordPress core, immediately following the release of its security patch.
While the onslaught of traffic does not unequivocally indicate successful breaches, site administrators are urged to apply updates without delay.
The vulnerability in question, identified as CVE-2026-119977, has been assessed with a high severity rating and a CVSS score of 8.1. It affects unpatched iterations of WordPress, specifically versions from 4.7 to 7.1.3.
This dangerous flaw was uncovered by researcher Umut Bayram, whose findings have heightened concerns among website administrators.
Mechanics of the Vulnerability
The exploit is predicated on a race condition encountered during a comprehensive WordPress update. When WordPress initiates an upgrade, it temporarily extracts installation files into the /wp-content/upgrade/ directory.
Unfortunately, on compromised sites, the naming convention of these folders can be accurately predicted, granting attackers potential access to these files while the update process is active.
Remarkably, this attack does not necessitate an existing WordPress user account or any direct action from users.
However, the attackers must precisely time their access, as the attack hinges on keeping the temporary installer files accessible for a critical window.
Once the update concludes, the files are purged, which necessitates exceptional timing, despite attackers repeatedly targeting known URLs.
According to an analysis by Wordfence, this illicit access could empower an attacker to finalize the installation, create an administrator account, and subsequently inject malevolent PHP code.
Such access can facilitate the installation of backdoors, manipulation of site content, or even data expropriation.
The CVE report delineates this vulnerability as stemming from a race condition involving file access, posing a significant risk to data confidentiality, integrity, and availability.
In its security communique, WordPress acknowledged that this flaw could result in remote code execution during update processes.
Inundation of Blocked Exploit Requests
Insights from Wordfence reveal that exploit activity escalated markedly between October 29 and November 1, peaking on October 30 when the company’s firewall obstructed over 74,000 requests.
It is crucial to note that these statistics account for blocked requests and do not equate to validated infections, successful code execution, or targeted sites.
While iterative automated checks heighten the likelihood of compromising an exposed installer, the raw number of requests fails to affirm whether attackers accomplished an exploit or retained access.
Advisories and Indicators of Compromise
WordPress promptly rectified the vulnerability in its October 28 security release, with corrections also backported for earlier versions.
Administrators are strongly advised to upgrade to version 7.1.4 or the relevant patched release for their version after confirming a successful completion of the automatic update.
WordPress recommends immediate updates, noting that only the latest version receives ongoing support.
Concurrently, Wordfence suggests constraining public access to PHP files residing in the /wp-content/upgrade/ directory prior to the updating process, necessitating the implementation of an advanced protection mode due to the unique loading environment of temporary PHP files.
Wordfence’s report enumerates the following indicators of compromise:
- 103.59.160[.]171 – IPv4 address
- 2001:df1:e8c0[::]106b – IPv6 address
- 51.89.103[.]78 – IPv4 address
- 185.177.72[.]61 – IPv4 address
- 195.3.220[.]7 – IPv4 address
- 96.62.218[.]148 – IPv4 address
- 20.217.186[.]29 – IPv4 address
- 87.58.197[.]83 – IPv4 address
- 154.26.238[.]8 – IPv4 address
- 20.46.43[.]126 – IPv4 address
Additionally, relevant paths and files that warrant scrutiny include /wp-content/upgrade/, setup-config.php, and the installer URL example: /wp-content/upgrade/wordpress-6.9.11/wp-admin/setup-config.php.
Site proprietors should diligently verify their installed WordPress version and ensure that the mitigation for their respective branch has been successfully applied.
Source link: Mezha.net.
