HighCVE
WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours
The Hacker News·Source published ·1 min read
What happened?
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system.
Key details
- A high-severity remote code execution flaw affects WordPress Core versions 4.7 through 7.1.3 with a CVSS score of 8.1.
- The vulnerability stems from predictable, web-accessible staging paths used during full-package core upgrades.
- Unauthenticated attackers can execute code by hitting a narrow window while WordPress unpacks a complete Core update.
- Wordfence blocked 62,969 attack attempts targeting the vulnerability over the past 24 hours.
- Two large sources polled small groups of sites for roughly 14.5 hours, showing sustained attempts to catch the brief upgrade window.
Affected
- WordPress Core versions 4.7 through 7.1.3 are affected.
What to look for
- Suspicious requests to PHP files under wp-content/upgrade directory.
- Unfamiliar administrator accounts, plugins, or PHP files.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.