Zaifliklar
Yangi WordPress zaifligi hujumchilarning nishonida
Tahdid ishtirokchilari yangi yuqori darajadagi WordPress zaifligini tuzatishlar tarqatilgandan bir necha soat ichida ekspluatatsiya qilishga urinishni boshladilar, deb ogohlantiradi Defiant.
28-oktabrda WordPress 7.1.4 da tuzatilgan xavfsizlik nuqsoni WordPress yangilash jarayoniga ta'sir qiladi va masofaviy kod bajarish uchun ekspluatatsiya qilinishi mumkin.
Defiant ma'lumotiga ko'ra, bu WordPress Core yangilash jarayonidagi poyga sharti (race condition) bo'lib, autentifikatsiyasiz ekspluatatsiya qilinishi mumkin. Biroq hujum murakkabligi yuqori. Zaiflikka hali CVE identifikatori berilmagan.
Zaiflik yangilanishlar paytida bashorat qilinadigan, veb orqali kirish mumkin bo'lgan tayyorlash yo'llaridan kelib chiqadi. Yangi fayllar ko'plab serverlarda vebdan kirish mumkin bo'lgan bashorat qilinadigan katalogga ochiladi.
"Hujumchiga o'rnatuvchi fayllarni o'z ichiga olgan to'liq paket yangilanishi, tayyorlash daraxtiga veb va PHP kirishi, bashorat qilinadigan yoki aniqlangan tayyorlash yo'li, shuningdek WordPress vaqtinchalik fayllarni tozalashdan oldin hujumni yakunlash uchun yetarli vaqt kerak," deb tushuntiradi Defiant.
Veb-xavfsizlik firmasi ma'lumotiga ko'ra, tahdid ishtirokchilari allaqachon zaiflikni ekspluatatsiya qilishga urinishmoqda, zaif yo'llarni qayta-qayta tekshirish orqali soniyalar davom etadigan ekspluatatsiya oynasiga urinishmoqda.
O'qishni davom ettirish uchun reklama. Pastga aylantiring.
Hujumchi zaiflikni ekspluatatsiya qilish uchun saytda hisob qaydnomasiga ega bo'lishi shart emas, lekin ular "WordPress to'liq Core yangilanishini ochayotganda juda tor oynaga urishlari" kerak, deydi Defiant.
Xavfsizlik xatosini bartaraf etish uchun WordPress endi tayyorlash katalogini tasodifiylashtiradi, indeks himoyasini qo'shadi va tayyorlangan konfiguratsiya ma'lumotlarini xavfsiz ravishda ilgari surishni oldini oladi.
"Wordfence telemetriyasi shuni ko'rsatadiki, tahdid ishtirokchilari allaqachon zaiflikni faol ravishda ekspluatatsiya qilishga urinishmoqda. Yangi xavfsizlik devori qoidamiz joylashtirilgandan to'qqiz daqiqa o'tib birinchi moslik qayd etildi. Birinchi 21 soat ichida tayyorlangan setup-config.php o'rnatuvchi yo'llariga qaratilgan 18 500 dan ortiq so'rov qayd etildi," deydi Defiant.
Wordfence muvaffaqiyatli buzilishlar haqida xabar bermagan.
Zaiflik uchun tuzatishlar WordPress 7.1.4 ga kiritilgan va WordPress 4.7 gacha bo'lgan tarmoqlarga orqaga moslashtirilgan.
WordPress 7.1.4 22 ta xavfsizlik nuqsoni, jumladan bir nechta XSS zaifliklari, interaktivlik API muammolari, autentifikatsiyasiz ma'lumot oshkor qilish xatosi va avtorizatsiya zaifligi uchun tuzatishlarni o'z ichiga oladi, shuningdek yaqinda eMudhra bekor qilinishini aks ettirish uchun ildiz sertifikatlarini yangilaydi.
Bog'liq: Maksimal darajadagi GitLab zaifligi Alpine Linux ga qarshi ekspluatatsiya qilinmoqda
Bog'liq: TeamViewer xatosi zararli xostlarga qo'llab-quvvatlash texniklarining mashinalarini egallashga imkon berishi mumkin
Bog'liq: Cisco SD-WAN nol-kun ekspluatatsiyasi Volt Typhoonning "Jim Poyezd" tarmog'iga bog'langan
Bog'liq: Xitoylik xakerlar past darajadagi ESXi jurnal xatosini nol-kun sifatida jimgina ishlatishdi
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Vulnerabilities
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
By
Ionut Arghire
| October 30, 2026 (8:04 AM ET)
*
Threat actors started exploiting a new high-severity WordPress vulnerability within hours of patches rolling out, Defiant warns.
Patched on October 28 in WordPress 7.1.4, the security defect impacts the WordPress update process and can be exploited for remote code execution.
According to Defiant, it is a race condition in WordPress’s Core update process that can be exploited without authentication. The attack complexity, however, is high. No CVE identifier has been assigned to the vulnerability yet.
The weakness stems from predictable, web-accessible staging paths during the upgrades. New files are unpacked into a predictable directory that is accessible from the web on many servers.
“The attacker needs a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and enough time to complete the attack before WordPress cleans up the temporary files,” Defiant explains.
According to the web security firm, threat actors are already attempting to exploit the vulnerability, polling the vulnerable paths repeatedly in their attempts to hit the seconds-long exploitability window.
Advertisement. Scroll to continue reading.
While an attacker does not need an account on the site to exploit the flaw, they do need “to hit a very narrow window while WordPress is unpacking a complete Core update,” Defiant says.
To address the security bug, WordPress now randomizes the staging directory, adds an index guard, and prevents the unsafe promotion of staged configuration data.
“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths,” Defiant says.
Wordfence has not reported successful compromises.
Fixes for the vulnerability were included in WordPress 7.1.4 and backported to branches through WordPress 4.7.
WordPress 7.1.4 includes patches for 22 security defects, including several XSS flaws, interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness, and also updates the bundled root certificates to reflect the recent eMudhra revocation.
Related:Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related:TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
Related:Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Related:Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Adobe, Veeam, Juniper Networks Patch Critical Vulnerabilities
- Over 41,000 DHS Employee Records Leaked Online
- HHS Filing Puts iRhythm Data Breach Toll at 8.2 Million
- Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
- Ukrainian Hive and Nefilim Ransomware Affiliate Gets 70 Months in US Prison
- Chrome and Firefox Updates Patch Over 200 Vulnerabilities
- China-Linked Hackers Exploit PHP2Shell to Root Firewalls
- Hackers Start Probing Fresh Oracle EBS Vulnerability
Latest News
- Drupal Commerce Core Vulnerability Exploited Against Online Stores
- $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
- Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
- TeamViewer Flaw Could Let Malicious Hosts Take Over Support Technicians’ Machines
- $6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor
- When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
- Google Touts Powerful Cybersecurity Capabilities in Gemini 4 Carbon Model
- How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI
Trending
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Node2Shell: Brotli Flaw Triggers Patching Across Microsoft, Node.js, Python Packages
CISA Warns of Node2Shell Exploitation as Honeypots Log Attack Attempts
Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Hackers Start Probing Fresh Oracle EBS Vulnerability
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Quantum eMotion has named Wayne Teeple as CTO.
Guy Ellis has been appointed CEO of NCC Group.
Noma Security has named Bobby Shoker as CFO and Alberto Rodrigues as CCO.
More People On The Move
Expert Insights
*
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)