AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) faol foydalanish dalillari tufayli WordPress yadrosi zaifligini Ma'lum foydalanilgan zaifliklar katalogiga kiritdi.
CVE-2026-119977 sifatida aniqlangan ushbu zaiflik autentifikatsiyadan o'tmagan hujumchilarga ma'lum dasturiy ta'minot yangilash oynasi davomida server tomonidagi kodni bajarish imkonini beradi.
CISA ushbu zaiflikni 2026-yil 3-noyabrda katalogga qo'shdi va federal fuqarolik agentliklari uchun tuzatish muddatini 6-noyabr deb belgiladi. Zaiflik CVSS v3.1 balli 8.1 ga teng bo'lib, yuqori potentsial ta'sirni ko'rsatadi, garchi foydalanish aniq vaqtni talab qilsa ham.
E'lon qilingan CVE yozuviga ko'ra, zaiflik WordPress 4.7 dan 7.1.3 gacha bo'lgan tarmoqlarga ta'sir qiladi. U zaif uchinchi tomon plagin yoki mavzudan emas, balki to'liq paket yadrosi yangilanishlari davomida yaratiladigan bashorat qilinadigan, veb orqali kirish mumkin bo'lgan tayyorlash yo'llaridan kelib chiqadi.
Ta'sirlangan yangilanishlar davomida WordPress o'rnatish fayllarini wp-content/upgrade ostidagi vaqtinchalik kataloglarga chiqaradi. Agar ushbu kataloglar umumiy kirish va PHP bajarilishini ruxsat etsa, hujumchi tozalash tugallanmasdan oldin tayyorlangan setup-config.php o'rnatuvchisiga yetib borishi mumkin. Bu ta'sir haqiqiy WordPress ma'lumotlarisiz PHP kod bajarilishini yoqishi mumkin.
Muammo tekshirish vaqti, foydalanish vaqti poyga sharti yoki CWE-367 sifatida tasniflanadi. Uning asosiy xususiyati shundaki, resurs holati tekshirish va foydalanish o'rtasida o'zgarishi mumkin, bu esa xavfsiz qayta ishlash haqidagi taxminlarni buzadi. Bu yerda foydalanish imkoniyati yangilash hayot sikli davomida mavjud.
Oldingi WordPress foydalanish hisobotlari 24 soat ichida 58 693 ta bloklangan hujum urinishlarini hujjatlashtirgan. Ushbu aniqlashlar muvaffaqiyatli buzilgan veb-saytlar soniga teng emas, balki foydalanish urinishlarini ifodalaydi.
WordPress yangilash zaifligini 28-oktabrda chiqarilgan 7.1.4 versiyasida bartaraf etdi. Tadqiqotchi Umut Bayram uni xabar qilgani uchun e'tirof etildi. Sotuvchi darhol yangilanishni tavsiya qildi va WordPress 4.7 dan boshlab mos tarmoqlar uchun xavfsizlik orqaga moslashtirishlarini e'lon qildi, orqaga moslashtirishlar tayyor bo'lganda jo'natilishini ta'kidlab.
Xavfsizlik chiqarilishi tahlili tasodifiy tayyorlash kataloglari, indeks himoyasi va tayyorlangan konfiguratsiya ma'lumotlarining xavfsiz ko'tarilishini cheklashni o'z ichiga olgan himoyalarni tavsiflaydi. Administratorlar avtomatik yangilanish muvaffaqiyatli tugallangan deb taxmin qilish o'rniga o'rnatilgan relizni tekshirishlari kerak.
Ta'minlangan CISA yozuvi BOD 26-04 bo'yicha sud-tibbiy triage talab qiladi va ransomware ishtiroki noma'lum deb ro'yxatga oladi. Operatorlar sotuvchi yumshatish ko'rsatmalariga amal qilishlari va yaqindagi yangilanishlar atrofidagi shubhali faoliyatni tekshirishlari kerak.
Oldin xabar qilingan WordPress SQL in'ektsiya hujumlaridan farqli o'laroq, ushbu zaiflik vaqtinchalik yangilash infratuzilmasini maxsus nishonga oladi, bu esa yangilash yo'li ta'sirini tuzatish va hodisa ko'rib chiqishning markaziga aylantiradi.
SOCingizga hodisalarni tez to'xtatish uchun ogohlantirish kontekstini bering.16K SOCdan tahdid razvedkasini integratsiya qiling.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.
This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window.
CISA added this vulnerability to the catalog on November 3, 2026, and set a remediation deadline of November 6 for affected federal civilian agencies. The vulnerability has a CVSS v3.1 score of 8.1, indicating a high potential impact, although exploitation requires precise timing.
According to the published CVE record, the vulnerability affects WordPress branches dating from 4.7 through 7.1.3. It stems from predictable, web-accessible staging paths created during full-package Core upgrades, rather than a vulnerable third-party plugin or theme.
During affected updates, WordPress extracts installation files into temporary directories under wp-content/upgrade. If those directories permit public access and PHP execution, an attacker can reach the staged setup-config.php installer before cleanup completes. This exposure can enable PHP code execution without valid WordPress credentials.
The issue is classified as a time-of-check, time-of-use race condition, or CWE-367. Its defining characteristic is that a resource’s state can change between validation and use, undermining assumptions about safe processing. Here, the exploitable opportunity exists during the upgrade lifecycle.
Earlier WordPress exploitation reporting documented 58,693 blocked attack attempts within 24 hours. Those detections represent attempted exploitation, not an equivalent number of successfully compromised websites.
WordPress addressed the upgrade weakness in version 7.1.4, released October 28. Researcher Umut Bayram received credit for reporting it. The vendor recommended immediate updates and announced security backports for eligible branches through WordPress 4.7, noting that backports would ship as ready.
The security release analysis describes protections including randomized staging directories, an index guard, and restrictions on unsafe promotion of staged configuration data. Administrators should verify the installed release rather than assume an automatic update completed successfully.
The supplied CISA entry also requires forensic triage under BOD 26-04 and lists ransomware involvement as unknown. Operators should follow vendor mitigation instructions and investigate suspicious activity around recent upgrades.
Unlike previously reported WordPress SQL injection attacks, this vulnerability specifically targets temporary upgrade infrastructure, making update-path exposure central to remediation and incident review.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
