Cybersecurity · VIDEO
WordPress 7.1.4: RCE attack exploits vulnerability in the update phase
A new high-impact vulnerability in WordPress 7.1.4 allows remote code execution during the update process. Threat actors have started exploiting it immediately, with over 18,500 attempts recorded in 21 hours. The flaw, not yet assigned a CVE, exploits predictable staging paths during updates.
KEY TAKEAWAYS
- Vulnerability in WordPress 7.1.4 allows remote code execution during updates
- Defiant records 18,500 exploitation attempts in 21 hours
- Flaw exploits predictable staging paths, requires web access and precise timing
- Patch includes staging directory randomization and additional protections
- Vulnerability backported to WordPress 4.7, including 22 security fixes
Transcript
**Radio News Bulletin:**
A critical vulnerability in WordPress was exploited just nine minutes after patches were released, according to Defiant. The flaw, fixed on October 28 with WordPress 7.1.4, allows remote code execution through a race condition in the core update process.
The vulnerability exploits predictable staging paths during updates, creating a brief window for attackers to access temporary files in web-accessible directories. Wordfence detected over 18,500 suspicious requests in the first 21 hours, with bots probing vulnerable paths.
WordPress 7.1.4 also addresses 22 other security defects, including XSS vulnerabilities and authorization weaknesses. Mitigation measures include staging directory randomization and an index guard to reduce predictability of temporary paths.
This rapid exploitation underscores the importance of immediate patch application and continuous monitoring. Organizations are advised to implement proactive security measures, such as regular penetration testing and managed detection and response services.
WordPress, powering 43% of all websites, remains a prime target for attackers. Timely patching and robust update management are crucial for maintaining security and operational resilience.
