Attackers Probe New WordPress Core Update Flaw Hours After Patch

Threat actors started trying to exploit a newly patched high-severity WordPress vulnerability within hours of the fix, according to Defiant, the company behind Wordfence. The flaw is a race condition in WordPress's Core update process that can be triggered without authentication and could lead to remote code execution. No CVE identifier has been assigned yet.

The weakness comes from predictable, web-accessible staging paths used during upgrades. New files are unpacked into a directory that many servers expose to the web. Defiant says an attacker needs a full-package update containing the installer files, web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to finish before WordPress cleans up the temporary files. The company describes the attack complexity as high and the exploitability window as seconds long.

WordPress patched the issue on October 28 in version 7.1.4 and backported fixes to branches through WordPress 4.7. The release randomizes the staging directory, adds an index guard and blocks unsafe promotion of staged configuration data.

Defiant says its first firewall rule match came nine minutes after deployment, and that it logged more than 18,500 requests targeting staged setup-config.php installer paths in the first 21 hours. Wordfence has not reported successful compromises.

Version 7.1.4 also carries patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug and an authorization weakness, plus updated bundled root certificates reflecting the recent eMudhra revocation.

Site operators should confirm they are running a patched release or a backported branch, and treat repeated requests to staged installer paths as worth investigating.