In a striking demonstration of cyber vulnerability, attackers commenced exploitation of a newly patched flaw in WordPress within a mere 48 hours of its disclosure.
This vulnerability, intricately embedded within the WordPress core, allows malicious actors to execute arbitrary code on affected websites during the installation of updates.
On October 28, 2026, WordPress released version 7.1.4 to address this critical security lapse. However, security firm Wordfence reported thwarting an alarming 62,969 attempts to exploit this vulnerability within a single day following the update’s rollout.
Entities utilizing WordPress for various purposes—including businesses, nonprofit organizations, and healthcare institutions—are strongly urged to implement the update immediately.
Additional Fixes Addressed in WordPress Version 7.1.4
The primary focus of version 7.1.4, launched on October 28, is security enhancement. Beyond rectifying the pivotal code execution issue, this update mitigates several stored cross-site scripting (XSS) vulnerabilities, addresses a denial-of-service predicament, and resolves two distinct information leakage concerns.
Furthermore, the update refreshes WordPress’s bundled root certificates following the revocation of certificates by eMudhra. Among all the issues corrected, the code execution flaw has emerged as the primary target for attackers.
Aaron Jorbin, the author of the release announcement, advised users to “update your sites without delay.”
A GitHub security advisory released shortly thereafter identified the flaw as a timing vulnerability within the update mechanism.
If a malicious user acts swiftly during an ongoing upgrade, it is possible for them to execute their own code on the affected server. Presently, no CVE identification has been assigned to the flaw.
Mechanics of the WordPress Vulnerability
During a full-package core update, WordPress initially extracts new files into a designated directory within the upgrade folder. According to the advisory, this directory is conspicuously named and accessible via the public internet.
This pivotal detail presents a significant risk. An assailant who requests the appropriate file momentarily, prior to WordPress completing its cleanup, can manipulate the server to execute arbitrary PHP code.
Successfully executing this exploit is not straightforward. The attacker must align four specific conditions: a full-package update in progress, web access to the temporary directory, a predictable path, and a narrow time frame before file deletion commences. Under optimal circumstances, this window may last only moments.
Impacted Sites by the WordPress Vulnerability
The advisory details that every WordPress release from 4.7 through 7.1.3 is deemed vulnerable, also specifying the patched version for each branch, which includes 7.0.8, 6.9.11, 6.8.12, and 5.9.20.
The WordPress project confirmed that the patch has been backported to all branches still receiving security updates, extending as far back as version 4.7. The organization stressed that only the most recent version is under active support.
Not every site is susceptible to takeover via this bug; the risk escalates significantly if an attacker targets a site during a full-package update.
Smaller websites are particularly vulnerable, often hosted on shared servers with default configurations that render them appealing targets for cybercriminals.
Attack Strategies Targeting the WordPress Vulnerability
Wordfence traced the vulnerability to full-package upgrades that frequently utilize easily guessable web-accessible paths.
Alex Thomas, a threat analyst at the firm, indicated that attackers quickly discerned the race condition and shifted their focus to capitalizing on it.
Notably, two predominant sources of attacks monitored small clusters of websites for approximately 14.5 hours, while others experimented with diverse folder and version names.
The observed patterns suggest a large-scale automated probing rather than deliberate targeting of specific victims. To date, there are no verified reports detailing the total number of sites compromised.
Assessing the Severity of the WordPress Vulnerability
Opinions diverge regarding the severity of the vulnerability. The Hacker News assigned it a CVSS score of 8.1, categorizing it as high risk. In contrast, the GitHub advisory classifies it as low severity.
This discrepancy likely stems from the divergence in ease of exploitability. Nonetheless, the significant volume of attack attempts coupled with the simplicity of the remedy suggests that the vulnerability warrants serious attention.
Future Implications of the WordPress Vulnerability
Probing efforts are expected to persist. Following the patching of a vulnerability, the remediation itself often serves as a detailed guide for those targeting unupdated sites.
The WordPress team has indicated that backports to older branches remain underway, with the next major release, WordPress 7.2, slated for December 8.
The advisory recognizes researcher Umut Bayram for identifying the flaw and responsibly reporting it. At this time, no alternative workaround exists, making the application of the patch the sole effective solution.
Source link: Thecyberexpress.com.
