A fresh WordPress security flaw has rapidly become the target of cyber attackers. The issue, a high-severity vulnerability, was identified shortly after patches were deployed, according to the security firm Defiant.
Details of the Exploited Vulnerability
Patched in WordPress version 7.1.4, the vulnerability affects the update process, potentially allowing remote code execution. It involves a race condition in the Core update mechanism, which can be exploited without user authentication, though the complexity of the attack is considerable. Notably, no CVE identifier has been assigned to this vulnerability as of now.
The root of the problem lies in predictable, web-accessible staging paths used during the update process. Files are unpacked into these directories, which are accessible on many servers, making them vulnerable to exploitation.
Exploitation Attempts in Action
To exploit the flaw, attackers require a complete update package with installer files, public web access, and PHP access to the staging area. Additionally, they must act quickly to exploit the vulnerability before temporary files are deleted by WordPress.
Defiant reports that attackers are actively trying to exploit this flaw, repeatedly targeting vulnerable paths to capitalize on the brief window of opportunity.
Security Measures and Future Outlook
In response, WordPress has introduced several security measures. These include randomizing the staging directory, adding an index guard, and preventing unsafe promotion of staged data. Wordfence telemetry has confirmed ongoing exploitation attempts, with the first attempt detected just nine minutes after deploying a new firewall rule.
Despite the active attempts, there have been no reports of successful exploits. The fixes for this vulnerability have been backported to versions as early as WordPress 4.7. Version 7.1.4 also addresses numerous other security issues, including XSS flaws and information disclosure bugs.
As WordPress continues to enhance its security protocols, website administrators are advised to update their systems promptly and remain vigilant to protect against potential threats.
