Attackers Target WordPress Update Vulnerability Patched in Version 7.1.4

Summary

Defiant says threat actors are probing an unauthenticated, high-severity race condition in WordPress core updates involving predictable staging paths. WordPress 7.1.4 patches it; Wordfence reported over 18,500 requests, with no successful compromises reported.

Key points

Defiant says attackers began targeting the vulnerability within hours of patches being released.
The flaw is an unauthenticated race condition in WordPress’s core update process; exploitation requires hitting a brief window while a complete update is unpacked.
Predictable, web-accessible staging paths can expose installer files during updates.
WordPress 7.1.4 randomizes the staging directory, adds an index guard, and prevents unsafe promotion of staged configuration data; fixes were backported through WordPress 4.7.
Wordfence reported more than 18,500 requests targeting staged setup-config.php paths during the first 21 hours of monitoring.
Wordfence has not reported successful compromises. No CVE identifier has been assigned.

Article Details

Vulnerability Types: Race condition
Remote code execution
Severity: High
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAttackers are attempting to exploit the unauthenticated race condition in the WordPress Core update process through web-accessible staging paths.

Vendors

DefiantThreat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns.

Products

Wordfence“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability.WordPressThreat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns.