Fresh WordPress Vulnerability in Attackers’ Crosshairs

Hi, what are you looking for?

Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.

Flipboard

Threat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns.Patched on October 28 inWordPress 7.1.4, the security defect impacts the WordPress update process and can be exploited for remote code execution.According to Defiant, it is a race condition in WordPress’s Core update process that can be exploited without authentication. The attack complexity, however, is high. No CVE identifier has been assigned to the vulnerability yet.The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,”Defiant explains.According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.Advertisement. Scroll to continue reading.While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Patched on October 28 inWordPress 7.1.4, the security defect impacts the WordPress update process and can be exploited for remote code execution.According to Defiant, it is a race condition in WordPress’s Core update process that can be exploited without authentication. The attack complexity, however, is high. No CVE identifier has been assigned to the vulnerability yet.The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,”Defiant explains.According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.Advertisement. Scroll to continue reading.While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

According to Defiant, it is a race condition in WordPress’s Core update process that can be exploited without authentication. The attack complexity, however, is high. No CVE identifier has been assigned to the vulnerability yet.The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,”Defiant explains.According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.Advertisement. Scroll to continue reading.While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,”Defiant explains.According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.Advertisement. Scroll to continue reading.While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,”Defiant explains.According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.Advertisement. Scroll to continue reading.While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.Advertisement. Scroll to continue reading.While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Wordfence has not reported successful compromises.Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recenteMudhra revocation.Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related:Max-Severity GitLab Vulnerability Exploited Against Alpine LinuxRelated:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ MachinesRelated:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ NetworkRelated:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day

Ionut Arghire is an international correspondent for SecurityWeek.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Original source

[email protected] (The Hacker News)