Critical WordPress Vulnerability Under Siege
A recently unveiled critical vulnerability within WordPress is facing widespread exploitation, with security firm MalCare reporting an alarming tally of over 3.18 million attempted breaches across sites safeguarded by its network.
This issue impacts WordPress versions tracing back to the 4.7 release, persisting through to version 7.1.1. In response to the threat, WordPress launched version 7.1.2 on September 22, urging all administrators to implement the update forthwith.
The vulnerability revolves around an unauthenticated path traversal exploit in the handling of WordPress page templates.
Under specific server configurations and theme settings, an assailant could manipulate WordPress to include a readable PHP file residing outside the current theme directory, which might culminate in remote code execution.
Remote code execution vulnerabilities are particularly perilous; successful exploitation can enable an attacker to execute arbitrary code on a compromised server, potentially wreaking havoc.
Initially, MalCare noted that its Vulnerability Shield thwarted over 5,000 exploitation attempts within hours of the attacks commencing. However, a subsequent report indicated that this number has surged to an astonishing 3.18 million.
This statistic reflects the attacks that were observed and blocked within MalCare’s customer network and should not be misconstrued as encompassing the entirety of attacks across the broader internet.
In the early stages, exploit attempts were primarily transmitted via URLs; however, within days, a significant shift occurred towards submissions resembling data entered through website forms.
This evolution underscores a persistent challenge faced by website security teams. Once details concerning a significant vulnerability are made public, attackers often modify their payloads and delivery mechanisms to circumvent firewall defenses and additional safeguards.
MalCare posits that artificial intelligence may play a role in accelerating the modification of malicious requests, although the company has not substantiated this claim with definitive evidence linking AI to the evolving attack strategies.
The broader security implications extend beyond merely unpatched websites.
Given that the vulnerability was present prior to its public announcement and the ensuing security patch, administrators should not assume that merely installing the latest WordPress release guarantees that their website has remained untouched.
Thus, operators of affected versions are strongly urged to update WordPress without delay, scrutinize server and security logs for any unusual activity, and conduct malware or integrity scans when feasible.
The recent statistics serve as a stark reminder that postponing patches can leave even modestly sized websites vulnerable once substantial vulnerabilities are made public.
For enterprises utilizing WordPress for e-commerce, content publishing, customer portals, or other essential services, software updates represent just one facet of a comprehensive response.
Administrators must also investigate any indications that exploitation may have occurred prior to the application of the patch.
Source link: Techbusinessnews.com.au.
