WordPress 7.1.4 patches a race condition that can expose a temporary installer during core updates, while Wordfence says attackers began probing for the vulnerability shortly after the security release.
WordPress has released version 7.1.4 to fix multiple security vulnerabilities, including a race condition that can allow an unauthenticated attacker to execute code on a server during a narrow window while WordPress Core is being updated.
The WordPress 7.1.4 security release was published October 28. WordPress recommends that administrators update immediately, while sites configured for automatic background updates should begin receiving the release automatically.
The most serious issue involves WordPress temporarily unpacking a complete core update beneath the wp-content/upgrade directory. The staged files can include the WordPress installer, creating a brief period in which the temporary copy may be reachable from the web on some server configurations.
According to analysis from Wordfence, an unauthenticated attacker who reaches the installer during that window can potentially progress from the temporary installation process to PHP code execution.
Attackers are already searching for the vulnerable window
Exploitation is difficult because the staging directory normally exists for only a few seconds. An attacker also needs the server to expose the staging location through the web and must reach it while a complete core update is in progress.
That has not stopped automated probing. Wordfence said its telemetry recorded the first match for a newly deployed firewall rule nine minutes after the rule was released. During the first 21 hours, the company recorded more than 18,500 requests targeting staged setup-config.php paths. Those requests show active exploitation attempts, but they don’t by themselves establish that attackers successfully compromised that number of sites.
WordPress 7.1.4 mitigates the issue by randomizing the staging directory, adding an index guard and preventing unsafe staged configuration data from being promoted. Wordfence said equivalent fixes were backported to affected WordPress branches as far back as version 4.7. The release also addresses numerous cross-site scripting, information disclosure, authorization and denial-of-service issues. Site owners should verify the installed version rather than assuming an automatic update has completed successfully.
Leave a Reply