HighCVE
CISA flags WordPress RCE flaw as actively exploited in attacks
BleepingComputer·Source published ·1 min read
What happened?
The US Cybersecurity and Infrastructure Security Agency (CISA) warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress vulnerability in the wild. [...]
Key details
- CISA confirmed active exploitation of a WordPress core vulnerability and added it to the Known Exploited Vulnerabilities catalog.
- Remote attackers without privileges can execute code on the server during the upgrade window.
- WordPress released version 7.1.4 on October 28 to patch the security issue.
- CISA ordered federal civilian agencies to secure their systems by Friday under Binding Operational Directive 26-04.
What to look for
- Wordfence blocked 13,095 attacks targeting the vulnerability in 24 hours.
Summarised by SecOraLens from BleepingComputer. Always read the original source before acting. How SecOraLens verifies advisories.