WordPress Updates Fix Code-Injection Flaw After Exploit Attempts
WordPress developers have released security updates for the content management system, and Wordfence has observed early attack attempts against one of the fixed flaws. The vulnerability can allow unauthenticated internet attackers to inject and execute malicious code while a core upgrade is running, creating a direct risk for websites whose updates are in progress.
The release announcement identifies WordPress 7.1.4 as the current update and lists backports for older branches: 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11 and 7.0.8. The release addresses nearly two dozen security issues. A CVE identifier was not available at the time of the report, and the flaw was assessed as high risk with a CVSS score of 8.1.
The affected process is narrower than a normal visit to a WordPress site. The core updater extracts a complete WordPress package into a predictable directory below wp-content/upgrade. The staging location is reachable from the internet during the upgrade, and attackers must win a short race against the installation and cleanup processes. Researchers found that the directory was available for only seconds in laboratory conditions, but that limitation has not prevented attempts in the wild.
Wordfence recorded more than 18,500 requests targeting vulnerable setup-config.php installation paths during the first 21 hours after introducing a firewall rule. Two of the most active sources repeatedly polled small groups of WordPress sites for about 14.5 hours, while other sources changed the staging paths and version names they requested. The available evidence confirms active probing and attack attempts, but does not establish how many sites were successfully compromised.
Administrators should verify that each WordPress instance is running the appropriate fixed release and apply the update promptly if it is not. Sites that were unpatched during the relevant period should also be examined for evidence of successful intrusion. Useful indicators include suspicious access in log files, unexpected PHP files below wp-content/upgrade, unfamiliar administrator accounts, unexpected plugins and PHP files that administrators did not place there.