WordPress Core Vulnerability Under Active Exploitation
Cybercriminals have been detected attempting to leverage a critical security vulnerability within WordPress Core, mere moments after the issuance of patches.
The exploitable weakness lacks a Common Vulnerabilities and Exposures (CVE) identifier and pertains to a remote code execution issue that affects WordPress Core versions 4.7 through 7.1.3.
This vulnerability carries a notable CVSS score of 8.1. Patches addressing the issue were deployed on October 28, 2026.
“The root of this vulnerability lies in the predictable and web-accessible staging paths utilized during comprehensive core upgrades,” stated the Wordfence team.
“Consequently, unauthenticated attackers could potentially execute arbitrary code on the server during the upgrade interval.”
According to Wordfence, the successful exploitation of this flaw mandates that an “attacker must exploit a fleeting opportunity while WordPress is unpacking a full Core update.”
The crux of the dilemma is that affected versions of WordPress unpack new files, integral to a complete Core upgrade, into a designated directory named “wp-content/upgrade,” which also houses the WordPress installer.
“Given that the staging directory is accessible via the web on numerous servers, an unauthenticated assailant can initiate interactions with the staged WordPress instance by requesting the installer at an opportune moment, thereby advancing to PHP code execution,” elucidated Alex Thomas, leader of the Wordfence Threat Response Team.
A nefarious entity capable of overcoming the race condition may procure the ability to execute server-side code, contingent upon the fulfillment of the following criteria:
- A full-package update that includes the installer files
- Public web and PHP access to the staging directory
- A predictable or ascertained staging path
- Sufficient time to execute the attack prior to WordPress clearing the temporary files
Although the temporal window for this exploit usually lasts merely seconds within controlled lab settings, cybercriminals have been observed to be incessantly polling vulnerable paths, such as “setup-config.php,” in a desperate bid to exploit the flaw.
In the last 24 hours alone, Wordfence reported having blocked 62,969 malicious attempts targeting this vulnerability.
“Two major sources persistently polled small clusters of sites over an extended period of approximately 14.5 hours, a pattern indicative of efforts to capture the brief upgrade opportunity,” remarked Thomas.
“Additionally, other sources experimented with various staging-directory layouts and version names.”
“While not every probing request targeted the precise vulnerable path, the extended polling and meticulous layout investigations elucidate that attackers swiftly comprehended the race condition and commenced focused efforts against it.”
In light of the current state of active exploitation, WordPress site administrators are strongly urged to promptly update to version 7.1.4.
Furthermore, vigilance is advised in monitoring for suspicious requests directed at PHP files located under “wp-content/upgrade,” as well as scrutinizing for unfamiliar administrator accounts, plugins, or PHP files.
Source link: Thehackernews.com.
