WordPress Addresses Actively Exploited Vulnerability, Allowing One Last Attack Opportunity During Update

New WordPress Update Poses Security Risk During Installation

The recent deployment of WordPress version 7.1.4, aimed at addressing the vulnerability indexed as CVE-2026-119977, inadvertently introduces a temporary security concern.

During the update, the unpacking mechanism utilizes legacy, unpatched code that may render websites susceptible to intrusions.

As a precaution, cybersecurity experts advocate for the restriction of web access to the wp-content/upgrade directory prior to initiating the update process.

Details of the Vulnerability

The identified flaw, CVE-2026-119977, impacts WordPress versions ranging from 4.7 to 7.1.3. Recently, it was cataloged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as an actively exploited vulnerability.

To mitigate risks, WordPress released critical patches in version 7.1.4, along with corresponding updates for preceding versions dating back to 4.7.

Notably, researcher Umut Bayram from Picus Security has highlighted a troubling aspect of the installation process: the presence of outdated code during the unpacking phase of the update.

For installations operating on WordPress version 5.9 or newer, the outdated framework designates a temporary upgrade folder with a predictable nomenclature, derived from the downloaded file’s name.

This predictability enables a potential attacker to exploit the window of opportunity, gaining access to the WordPress installer before the update executes file deletion procedures.

Mechanics of the Exploit

In meticulous detail, Bayram elucidates that an adversary who successfully intercepts the update window can establish a temporary instance of WordPress complete with their own database credentials.

This would allow them to log in and execute PHP scripts with the web server’s access rights, thereby facilitating unauthorized read or write operations within the live WordPress environment.

The underlying mechanism of the vulnerability operates as follows: during a core update utilizing a complete package, WordPress unpacks a variant of the new version into a temporary location situated within wp-content/upgrade.

This temporary setup indeed includes the WordPress installer, which, under normal circumstances, remains accessible via the web server.

Prior to the implementation of the fix, an attacker could manipulate this installer to inject a malicious wp-config.php file into the temporary environment, subsequently overwriting the authentic configuration file of the site during the update.

Although the patch introduces protections such as a randomized folder name and prevents a malicious wp-config.php from superseding the genuine file, these safeguards are only effective post-update. The updater responsible for applying the fix relies on the vulnerable legacy code.

Prompt Attack Attempts

Wordfence, the security firm that designated the CVE identifier, reported the onset of attack attempts a mere nine minutes after the deployment of a firewall rule on the release day.

Two significant sources sustained efforts to probe various sites for approximately fourteen and a half hours—behavior that aligns with attempts aimed at exploiting the timing of updates. The severity of the vulnerability is underscored by its CVSS score of 8.1 out of 10.

Update Mechanics and Recommendations

It is essential to note that not every update process renders the installer vulnerable. Complete packages invariably contain the installer files, while partial packages—designed for specific version upgrades—only pose a risk if they include these files.

Currently, the update service from WordPress.org provides partial packages for intra-branch updates (e.g., 7.1.3 to 7.1.4) and complete packages for inter-branch transitions (e.g., 7.0.7 to 7.1.4). Sites employing automatic background updates will utilize the same susceptible updater to implement the fix.

On WordPress versions 4.4 through 5.8, the older code obscures the folder name by appending random characters, thereby concealing it unless revealed through errors or other means.

Safeguarding Measures

Bayram delineates two prudent strategies to mitigate this risk:

• Restrict web access to wp-content/upgrade prior to updating. This directory is engaged directly by WordPress on disk, meaning blocking access will not hinder updates.
  
  For Nginx servers, incorporate the directive location ^~ /wp-content/upgrade/ { deny all; }. For Apache servers, use Require all denied within a block in the virtual host configuration for this folder.
  
  If utilization of .htaccess is mandatory, insert RedirectMatch 403 ^/wp-content/upgrade/ in the root .htaccess file above the WordPress rewrite rules, ensuring not to place an .htaccess file within wp-content/upgrade due to the legacy updater’s file deletion process.
  
  Confirm that an access attempt to /wp-content/upgrade/ yields a 403 response before proceeding with the update.
  
• Opt for manual updates outside the web root. Begin by creating backups of site files and the database, then decompress the new release in a directory that is not accessible to the web server.
  
  Transfer the core files into the designated locations without altering wp-config.php or wp-content, followed by executing the WordPress database update. This approach ensures that no temporary installer exists in a publicly accessible directory.

It is important to note that utilizing WP-CLI’s wp core update command is not advisable, as it employs the same updater and unpacks files into the same vulnerable directory.

Lastly, WordPress versions 4.6 and earlier will no longer benefit from security updates. Bayram emphasizes that the vulnerability has roots extending back to WordPress 2.7, initially released in 2008, underscoring the necessity for sites operating on outdated versions to transition to supported iterations.

For those who have remained on an affected version post-release, Wordfence encourages vigilance in monitoring for unusual requests directed at PHP files located under wp-content/upgrade, the presence of unidentified administrator accounts, anomalous plugins, and unauthorized PHP files within the wp-content/upgrade directory.

Bayram further elucidated on November 6 that the potential exposure of a partial update is contingent on the specific package’s contents.

A partial package encompasses solely the files altered between two iterations; if these modifications do not include installer files, the temporary copy cannot function as a WordPress installation.

WordPress also defaults to complete packages should the site’s core files fail to conform to official checksums or in cases of reinstallation.

“The pivotal aspect is not merely whether the package is partial or complete,” Bayram stated, “but whether the existing updater on the site has been rectified.”

Once version 7.1.4 or its branch equivalent has been implemented, all subsequent updates will employ a randomly generated folder name, negating the risk of a wp-config.php from the temporary copy overwriting the legitimate file.

Source link: News.lavx.hu.