Xakerlar WordPress Core'dagi autentifikatsiyasiz masofaviy kod bajarish (RCE) zaifligini ekspluatatsiya qilishga urinmoqda, bu zaiflik dasturiy ta'minot yangilanishlari paytida qisqa vaqt oralig'ida yuzaga keladi.
Wordfence ma'lumotlariga ko'ra, 24 soat ichida 58 693 ta hujum bloklandi — bu deyarli 60 000 urinishni anglatadi, lekin muvaffaqiyatli buzilishlar tasdiqlanmagan.
WordPress 2026-yil 28-oktabrda 7.1.4 versiyasini chiqardi, unda 22 ta xavfsizlik zaifligi tuzatildi. Yangilanishdagi xato muhim, chunki hujumchilar ekspluatatsiya urinishlari uchun na hisob qaydnomasi, na foydalanuvchi o'zaro ta'siri talab qilinadi, garchi bir nechta atrof-muhit va vaqt shartlari mos kelishi kerak.
CVE-2026-119977 sifatida kuzatiladigan bu zaiflik CVSS balli 8.1 ga teng va WordPress 4.7 dan 7.1.3 gacha versiyalariga ta'sir qiladi. Uning yuqori hujum murakkabligi cheklovchi vaqt talablari bilan bog'liq, lekin agar hujumchi muvaffaqiyatga erishsa, oqibatlar cheklangan bo'lishi shart emas.
To'liq paketli Core yangilanishlari paytida zaif o'rnatmalar fayllarni wp-content/upgrade ostidagi bashorat qilinadigan kataloglarga chiqaradi. Bu vaqtinchalik joylar o'rnatuvchi komponentlarini o'z ichiga oladi va yangilanish jarayoni davomida veb-sayt orqali ochiq qolishi mumkin.
Autentifikatsiyasiz hujumchi tozalashdan oldin sahnalashtirilgan setup-config.php fayliga kirsa, vaqtinchalik o'rnatish bilan o'zaro ta'sir qilishi va PHP kodini bajarishi mumkin.
Ekspluatatsiya o'rnatuvchi fayllar, ommaviy kirish mumkin bo'lgan sahnalashtirish yo'llari, ushbu katalog daraxtida PHP bajarilishi va hujumni yakunlash uchun yetarli vaqt talab qiladi.
Laboratoriya kuzatishlari bu oyna faqat bir necha soniya davom etishini ko'rsatadi. Hujumchilar takroriy so'rovlar orqali kompensatsiya qiladi, yangilanish ularni ochib qo'ygan paytda o'rnatuvchi yo'llariga aniq yetib borishga urinadi.
Wordfence o'zining xavfsizlik devori qoidasi joylashtirilganidan to'qqiz daqiqa o'tgach birinchi mos kelishni va birinchi 21 soat ichida sahnalashtirilgan o'rnatuvchi yo'llariga 18 500 dan ortiq so'rovni qayd etdi. Ikki asosiy manba taxminan 14,5 soat davomida kichik veb-saytlar guruhini so'rov qilgani xabar qilindi.
Xabar qilingan tuzatish sahnalashtirish kataloglarini tasodifiylashtiradi, indeks himoyasini qo'shadi va sahnalashtirilgan konfiguratsiya ma'lumotlarining xavfsiz ko'tarilishini oldini oladi. Xavfsizlik tuzatishlari eski ta'sirlangan tarmoqlarga ham orqaga moslashtirildi, garchi WordPress faqat o'zining so'nggi versiyasini faol qo'llab-quvvatlanadigan deb belgilaydi.
Wordfence 28-oktabrda soat 20:30 UTC da Premium, Care va Response mijozlari uchun xavfsizlik devori qoidasini joylashtirdi. Bepul foydalanuvchilar standart 30 kunlik kechikish ostida 27-noyabrda qoidani olishlari rejalashtirilgan.
Kengaytirilgan himoya muhim, chunki ekspluatatsiya so'rovlari avval WordPress'ni yuklamasdan turib sahnalashtirilgan PHP fayllariga kirishi mumkin. Shuning uchun administratorlar qoidani olishning o'zi himoyani kafolatlamasligini nazarda tutib, xavfsizlik devori optimallashtirilishini tekshirishlari kerak. Xavfsizlik devori filtrlashi yangilash o'rnini bosmaydi.
Sayt egalari Boshqaruv paneli > Yangilanishlar bo'limini tekshirib, WordPress 7.1.4 yoki tegishli tuzatilgan tarmoq versiyasini o'rnatishlari kerak. Shuningdek, ular wp-content/upgrade ostidagi kutilmagan so'rovlar uchun jurnallarni tekshirishlari va notanish administrator hisoblari, ruxsatsiz plaginlar va shubhali PHP fayllarini tekshirishlari kerak.
Yangilash zaif xatti-harakatni yo'q qiladi, skanerlash va xavfsizlik devori nazorati esa tuzatishni to'ldiradi.
Biroq, muvaffaqiyatli yangilanish ham, bloklangan hujum statistikasi ham avval ochiq qolgan server buzilishdan qochganini isbotlamaydi; shubhali topilmalar hali ham tekshiruv va hodisa javobini talab qiladi.
ANY.RUN yordamida tahdid tekshiruvlarini soddalashtiradigan va qo'lda mehnatni kamaytiradigan 16 000+ SOC jamoalariga qo'shiling. Jamoangiz uchun o'rganing
Hackers are attempting to exploit an unauthenticatedremote code execution vulnerability in WordPress Core, targeting a brief exposure window during software updates.
The supplied Wordfence record reports 58,693 blocked attacks within 24 hours, representing nearly 60,000 attempts rather than confirmed successful compromises.
WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The upgrade flaw matters because attackers need neither an account nor user interaction to attempt exploitation, though several environmental and timing conditions must align.
Tracked as CVE-2026-119977, the vulnerability carries a CVSS score of 8.1 and affects WordPress versions 4.7 through 7.1.3. Its high attack complexity reflects restrictive timing requirements, not necessarily limited consequences if an attacker succeeds.
During full-package Core upgrades, vulnerable installations extract files into predictable directories beneath wp-content/upgrade. These temporary locations contain installer components and can remain accessible through the website while the update progresses.
An unauthenticated attacker reaching the staged setup-config.php file before cleanup can interact with the temporary installation and potentially achieve PHP code execution.
Exploitation requires installer files, publicly reachable staging paths, PHP execution within that directory tree, and enough time to complete the attack.
Laboratory observations suggest this window lasts only seconds. Attackers compensate through repeated polling, attempting to reach installer paths precisely when an update exposes them.
Wordfence reported its first firewall-rule match nine minutes after deployment and more than 18,500 requests targeting staged installer paths during the first 21 hours. Two major sources reportedly polled small groups of websites for approximately 14.5 hours.
The reported fix randomizes staging directories, adds an index guard, and prevents unsafe promotion of staged configuration data. Security fixes were also backported to older affected branches, although WordPress identifies only its latest version as actively supported.
Wordfence deployedits firewall rule on October 28 at 20:30 UTC for Premium, Care, and Response customers. Free users are scheduled to receive the rule on November 27 under the standard 30-day delay.
Extended Protection matters because exploit requests can access staged PHP files without first loading WordPress. Administrators should therefore verify firewall optimizationinstead of assuming that receiving the rule alone guarantees coverage. Firewall filtering does not replace patching.
Site owners should check Dashboard > Updates and install WordPress 7.1.4 or the corresponding patched branch release. They should also inspect logs for unexpected requests beneath wp-content/upgrade and investigate unfamiliar administrator accounts, unauthorized plugins, and suspicious PHP files.
Updating removes the vulnerable behavior, while scanning and firewall controls complement remediation.
However, neither a successful update nor blocked attack statistics establish that a previously exposed server escaped compromise; suspicious findings still require investigation and incident response.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort.Explore for your team