Attacks on Newly Patched WordPress Vulnerability
Within a mere 48 hours following the release of an urgent fix, assailants began exploiting a recently discovered vulnerability within the WordPress core.
On October 28, 2026, WordPress launched version 7.1.4, designed to rectify a flaw that enables malicious actors to execute code on a site during its update installation process.
Security firm Wordfence reported thwarting a staggering 62,969 attacks directed at this weakness in just a span of 24 hours.
Website administrators operating WordPress for businesses, organizations, or healthcare facilities are strongly urged to implement updates immediately.
Overview of WordPress 7.1.4
The release of WordPress version 7.1.4 on October 28 was primarily a security update. In addition to the critical code execution rectification, it addresses several stored cross-site scripting vulnerabilities, a denial-of-service issue, alongside two distinct information leaks.
Moreover, it refreshes the bundled root certificates following the revocation by eMudhra. The code execution flaw became the focal point for attackers.
Aaron Jorbin, who authored the release announcement, advised users to “update your sites without delay.”
A GitHub security advisory released the following day highlighted this vulnerability as a timing weakness within the update framework: should an unauthorized user act swiftly during an upgrade, they might successfully run their own code on the server. At present, it lacks an associated CVE number.
Mechanics of the Vulnerability
During a full-package core update, WordPress initially unpacks new files into a specific directory in the upgrade folder.
The advisory denotes that this directory had a predictable name and could be publicly accessed on the web.
If an adversary requests the correct file at precisely the right moment – specifically, before WordPress conducts the cleanup – they could manipulate the server into executing arbitrary PHP code.
Reports from Hacker News indicate that the unpacked files include the WordPress installer. Attackers appear to attempt access to various paths, such as setup-config.php.
To exploit this vulnerability, an attacker requires a full-package update, web access to the temporary folder, a predictable path, and a brief time frame before the files are purged. In controlled conditions, this time window may amount to just seconds.
Impact of the WordPress Core Bug
The advisory explicitly identifies all WordPress releases from version 4.7 up to 7.1.3 as vulnerable, outlining respective fixed versions for each branch, including 7.0.8, 6.9.11, 6.8.12, and 5.9.20.
The project confirmed that patches were extended back to all branches under active security maintenance, extending retroactively to version 4.7, while emphasizing that only the latest version remains actively supported.
Though not all sites may be susceptible to takeover, the chances increase significantly if an attacker exploits a site during a full-package update.
Furthermore, many smaller websites are hosted on shared servers with default settings, which presents an appealing target for cybercriminals. Timeline of Events from the Patch to Initial Attacks. Sources: WordPress.org, GitHub, The Hacker News.
Current Endeavors of Attackers
According to Wordfence, the vulnerability stems from the consistent use of easily guessable, web-accessible paths in full-package upgrades.
Wordfence’s threat analyst, Alex Thomas, remarked that attackers swiftly grasped the race condition and began focusing their efforts on it.
Reportedly, two of the most significant sources of attacks persistently polled small clusters of websites over a duration of approximately 14.5 hours, while other sources investigated varying folder and version names.
This influx of traffic resembles large-scale automated attempts at guessing vulnerabilities rather than pinpointing specific targets. As of now, there have been no definitive reports quantifying the actual number of compromised sites.
Assessment of the Vulnerability’s Severity
There exists some divergence among sources regarding the seriousness of the vulnerability. Hacker News assigned it a CVSS score of 8.1, which is deemed high.
Conversely, the GitHub advisory categorizes its severity as low. This disparity likely reflects the difficulty of successfully exploiting the flaw.
Nevertheless, it is prudent to treat it as a grave concern, given the frequency of attack attempts and the straightforward nature of the fix.
Recommended Actions
- Access the Updates section in your WordPress dashboard and install version 7.1.4 or the equivalent fixed release for your branch. Websites with automatic updates should implement this patch independently, but confirmation is advisable.
- Verify the version number displayed at the footer of the dashboard to ensure the update completed successfully.
- Consult with your hosting provider or developer to examine server logs for any unusual requests targeting PHP files within the wp-content/upgrade directory.
- Scrutinize your administrator roster, plugins, and uploaded files for any unauthorized additions.
- If any anomalies are detected, promptly change administrator passwords and enable two-factor authentication.
In the event a dubious plugin or concealed file is located, your site may already be compromised. Attackers frequently deploy backdoors or cryptocurrency miners upon executing their code.
Therefore, it is recommended to review guides detailing indicators associated with the XMRig miner, AsyncRAT backdoor, and trojan downloaders. Checklist for Site Administrators. Sources: WordPress.org, The Hacker News.
Future Projections
Anticipate continued probing from attackers, as a patched vulnerability serves as a detailed guide for anyone maintaining unpatched sites.
The WordPress project indicates that backports to earlier branches are ongoing, with the subsequent major release, version 7.2, scheduled for December 8.
The advisory extends credit to researcher Umut Bayram for responsibly identifying and reporting the vulnerability. Presently, no alternative workaround exists; therefore, immediate patching remains the sole remedy.
Source link: 2-spyware.com.
