Add Techlomedia as a Preferred Source on Google
While the installation of a security update is intended to fortify a website against threats, a flaw within the WordPress updater can inadvertently leave certain sites vulnerable during this critical process.
An assailant may take advantage of the fleeting interval while WordPress enacts the update to execute PHP code on the server, thereby potentially gaining unauthorized access to the live website.
This vulnerability, designated as CVE-2026-119977, impacts WordPress versions ranging from 4.7 to 7.1.3. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has incorporated it into its Known Exploited Vulnerabilities Catalog, affirming that malicious actors are exploiting this flaw.
Umut Bayram, a researcher from Picus Security, elucidates that the issue stems from the manner in which WordPress manages temporary files during core updates.
During the installation of a comprehensive update, WordPress extracts new files into a temporary directory located at wp-content/upgrade.
This directory, which houses the WordPress installer, is accessible through the web server. The problematic aspect lies in the fact that the update employs the older, vulnerable updater code to extract the package; consequently, attackers may anticipate the temporary directory’s name and access the installer prior to the deletion of these files by WordPress.
WordPress has deployed a resolution in version 7.1.4, alongside security updates for earlier supported releases.
This patch utilizes a randomized naming convention for the temporary directory, preventing a malicious wp-config.php file from compromising the live site’s configuration.
Yet, the initial update continues to utilize the outdated updater to unpack files, creating a final moment of vulnerability during this process.
The associated risk also hinges upon the nature of the update package. Partial packages, consisting solely of modified files, may lack the installer, while complete packages do include it.
WordPress has the capability of reverting to a comprehensive package if core files fail checksum verification or during reinstalls.
The crucial element revolves around whether the updater in operation on the site has received the necessary fix.
Bayram advises restricting web access to wp-content/upgrade prior to executing the security update. Given that WordPress interacts with this directory directly on the server, blocking HTTP requests to it does not impede the update’s progress.
For Nginx, the following directive should be appended:
location ^~ /wp-content/upgrade/ {
deny all;
}For Apache systems, incorporate Require all denied within a Directory block designated for the upgrade folder. If only the .htaccess file is available for modification, add the ensuing rule to the WordPress root .htaccess file, positioned above the WordPress rewrite rules:
RedirectMatch 403 ^/wp-content/upgrade/Confirm that attempts to access /wp-content/upgrade/ yield a 403 error prior to proceeding with the update.
It is vital not to place the .htaccess file within the upgrade directory, as the obsolete updater may delete it during the extraction phase.
An alternative approach involves executing a manual update outside the web root, ensuring that the web server cannot access the temporary files.
Notably, using WP-CLI’s wp core update command does not circumvent the issue due to its reliance on the same updater process.
WordPress versions 4.6 and earlier are devoid of security updates, thus necessitating that websites utilizing these versions transition to a supported release.
Wordfence has reported observing attempts at exploitation merely nine minutes after the implementation of a firewall rule targeting the vulnerability.
Two of the most frequently exploited sources continued to probe a limited number of websites for approximately 14.5 hours, indicating a systematic effort by attackers to target sites during their update procedures. The vulnerability itself is evaluated with a CVSS score of 8.1.
Site proprietors should remain vigilant, monitoring for any atypical requests to PHP files within the wp-content/upgrade directory, unfamiliar admin accounts, plugins not explicitly installed by them, and unexpected PHP files residing in the upgrade directory.
This incident serves as a poignant reminder that maintaining the currency of a WordPress installation often transcends the simplicity of pushing an update button.
Website owners are urged to secure the update mechanism, implement the fixed release, and scrutinize for signs indicative of security breaches.
Are you seeking assistance in securing or managing your WordPress website?
At Techlomedia Internet Services, we offer comprehensive support for businesses engaged in constructing, managing, and securing WordPress websites.
Our services encompass website development, server configuration, security assessments, vulnerability remediation, and much more.
Should your website require a thorough security evaluation or a more robust technical framework, do not hesitate to reach out to our team.
Source link: Techlomedia.in.
