Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns.
Patched on October 28 in WordPress 7.1.4, the security defect impacts the WordPress update process and can be exploited for remote code execution.
According to Defiant, it is a race condition in WordPress’s Core update process that can be exploited without authentication. The attack complexity, however, is high. No CVE identifier has been assigned to the vulnerability yet.
The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.
“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,” Defiant explains.
According to the web...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
