Wordfence blocked 62,969 attempts in 24 hours targeting a remote code execution vulnerability in WordPress Core, after the patch was released on October 28. The flaw affects versions 4.7 through 7.1.3 and allows an unauthenticated attacker to execute code on the server if they manage to act during a brief window in the update process.
The vulnerability has a CVSS score of 8.1 and does not yet have a CVE identifier. WordPress fixed the issue in version 7.1.4. Wordfence reported that exploitation attempts began shortly after a firewall rule was deployed; Techaeris places the first detected attempt nine minutes after that deployment.
The attack depends on getting the timing right
The issue lies in the full WordPress core update. During this process, the new files are extracted into a temporary directory under wp-content/upgrade. According to Wordfence, the staging path can be predictable and web-accessible on many servers, and its contents include the WordPress installer.
If an attacker requests that installer while the directory is available, they can interact with the staging copy and potentially execute PHP code. It is not enough for a site to be running a vulnerable version: exploitation requires a full package to be installing, the temporary tree to be accessible via the web and PHP, the path to be predictable or discoverable, and the attack to finish before WordPress deletes the temporary files.
In laboratory tests, the window lasted only a few seconds. For that reason, attackers did not limit themselves to a single request: they repeatedly probed vulnerable paths, including setup-config.php, to increase the chance of coinciding with an update in progress.
“Two of the largest sources repeatedly probed small groups of sites for about 14.5 hours, behavior consistent with trying to hit the brief update window.”
— Alex Thomas, head of Wordfence’s threat response team
Wordfence also observed other sources testing variations of temporary directories and version names. Not all requests used the exact vulnerable path, but the repeated probing and testing of specific structures suggested that the attackers had identified the race condition.
Version 7.1.4 fixes the flaw
WordPress recommends installing the security update immediately. Version 7.1.4 is available from WordPress.org or the administration dashboard, in the updates section; sites that support automatic updates may receive it in the background. The WordPress team said patches are also being prepared for branches that still receive security fixes, down to version 4.7.
According to Techaeris, the 7.1.4 fix randomizes the temporary directory, adds an index protection, and blocks an unsafe promotion of prepared configuration data. The update also includes fixes for other security issues. WordPress lists, among them, stored cross-site scripting vulnerabilities, exposure of unpublished Customizer changes, and a permissions issue in Notes.
Wordfence’s firewall rule was distributed about three hours after the update was released, according to Techaeris. Customers on its Premium, Care, and Response plans received it then; free users were scheduled to receive it on November 27, in line with the standard 30-day delay the company applies to those rules.
Wordfence had not reported any confirmed compromises at the time Techaeris published its report. Site owners should update to 7.1.4—or to the corresponding patched version for their installed branch—and check for suspicious requests to PHP files inside wp-content/upgrade, as well as unknown administrator accounts, plugins, or PHP files.
Sources: The Hacker News, Techaeris, WordPress News
