WordPress 2026-yil 28-oktabrda 7.1.4 versiyasini chiqardi, u 22 ta xavfsizlik zaifligini bartaraf etadi. Ular orasida hujumchilar faol ravishda foydalanayotgan autentifikatsiyasiz masofaviy kod bajarish (RCE) kamchiligi ham bor. Administratorlar yangilanish o'rnatilganligiga ishonch hosil qilishlari kerak, avtomatik fon yangilanishlari tugallangan deb o'ylamasliklari lozim.
Rasmiy reliz hujjatlarida saqlangan o'zaro sayt skriptlash (stored XSS), ma'lumot oshkor qilish, avtorizatsiya zaifliklari va xizmatdan voz kechish (DoS) bo'yicha tuzatishlar batafsil bayon etilgan. Eng jiddiy muammo Core yangilanish jarayoniga ta'sir qiladi va hujumchilarga PHP kodini hech qanday ma'lumotlarsiz bajarish uchun qisqa imkoniyat ochadi.
Yaqinda Wordfence maslahatiga ko'ra, tadqiqotchi Umut Bayram WordPress 4.7 dan 7.1.3 gacha versiyalarni qamrab oladigan masofaviy kod bajarish (RCE) zaifligini xabar qildi. Ushbu zaiflik CVSS balli 8.1 ga teng, bu sezilarli potentsial ta'sirni ko'rsatadi, garchi uni ishlatish uchun maxsus shartlar talab qilinsa ham.
To'liq Core paketlari yordamida yangilanishlar bajarilganda, zaif o'rnatishlar fayllarni wp-content/upgrade ostidagi bashorat qilinadigan kataloglarga ochadi. Ushbu vaqtinchalik fayllar WordPress o'rnatuvchisini ham o'z ichiga oladi.
Agar serverlar umumiy kirishni ruxsat etsa va ushbu tayyorlash katalogida PHP bajarilishini ta'minlasa, hujumchilar tayyorlangan o'rnatuvchini so'rashi mumkin. Bu server tomonida kod bajarilishiga olib kelishi mumkin.
Muvaffaqiyatli foydalanish hujumchilardan tayyorlash katalogini topishni va tozalashdan oldin o'zaro aloqani yakunlashni talab qiladi. Laboratoriya kuzatuvlari bu oynani soniyalarga qisqartirdi, bu esa alohida so'rovlardan ko'ra barqaror avtomatlashtirilgan so'rovni amaliyroq qiladi.
WordPress 7.1.4 tayyorlash kataloglarini tasodifiylashtiradi, indeks himoyasini qo'shadi va tayyorlangan konfiguratsiya ma'lumotlarining xavfsiz ko'tarilishini bloklaydi. Avval xabar qilingan WordPress yo'l-traversal RCE zaifliklaridan farqli o'laroq, bu hujum mavzu shabloni yechimi emas, balki vaqtinchalik yangilanish artefaktlariga bog'liq.
Ta'minlangan Wordfence hisobotiga ko'ra, uning xavfsizlik devori himoya qoidasi joylashtirilgandan to'qqiz daqiqa o'tib birinchi mos keladigan foydalanish urinishini qayd etdi. Birinchi 21 soat ichida tayyorlangan setup-config.php yo'llariga 18 500 dan ortiq so'rov yo'naltirildi.
Ikki taniqli manba taxminan 14,5 soat davomida kichik veb-saytlar guruhlarini qayta-qayta so'rov qildi. Ushbu kuzatuvlar faol foydalanish urinishlarini tasdiqlaydi, muvaffaqiyatli buzilishlarni emas.
Faollik zararli plaginlar bilan bog'liq boshqa WordPress hujumlaridan keyin kuzatilmoqda, garchi kirish mexanizmi farq qilsa ham.
Wordfence Premium, Care va Response mijozlari 28-oktabr soat 20:30 UTC da himoyani oldilar. Bepul foydalanuvchilar qoidani 27-noyabrda olishlari rejalashtirilgan.
Administratorlar Dashboard > Updates orqali 7.1.4 versiyasini tasdiqlashlari yoki mos tuzatilgan filial relizini o'rnatishlari kerak. Xavfsizlik tuzatishlari WordPress 4.7 gacha kengaytirilgan, ammo faqat eng so'nggi versiya faol qo'llab-quvvatlanadi.
Wordfence foydalanuvchilari Kengaytirilgan Himoyani (Extended Protection) yoqishlari kerak, chunki foydalanish WordPressni avval yuklamasdan to'g'ridan-to'g'ri PHP fayllarini so'raydi.
wp-content/upgrade ostidagi kutilmagan PHP so'rovlarini tekshiring, notanish administrator hisoblari va plaginlarini tekshiring va ruxsatsiz fayllarni skanerlash. Xavfsizlik devori himoyasi yamoqlashni to'ldiradi; u Core xavfsizlik yangilanishini almashtirmaydi va avval ochiq bo'lgan veb-sayt buzilmaganligini tasdiqlamaydi.
SOC-ga tezkor to'xtatish uchun ogohlantirish kontekstini bering.16K SOC dan tahdid razvedkasini integratsiya qiling.
WordPress released version 7.1.4 on October 28, 2026, which addresses 22 security vulnerabilities. Among them is an unauthenticated remote code execution flaw that attackers are actively exploiting. Administrators should ensure the update is installed, rather than assuming automatic background updates have completed.
The official release documentation details fixes spanning stored cross-site scripting, information disclosure, authorization weaknesses, and denial of service. The most consequential issue affects the Core upgrade process, exposing a brief opportunity for attackers to execute PHP code without credentials.
According to a recent Wordfence advisory, researcher Umut Bayram reported a remote code execution (RCE) vulnerability affecting WordPress versions 4.7 through 7.1.3. This vulnerability has a CVSS score of 8.1, indicating significant potential impact, though it requires specific conditions to exploit.
When updates are performed using complete Core packages, vulnerable installations unpack files into predictable directories under wp-content/upgrade. These temporary files include the WordPress installer.
If servers allow public access and permit PHP execution within that staging directory, attackers may request the staged installer. This could lead to server-side code execution.
Successful exploitation requires attackers to locate the staging directory and complete their interaction before cleanup. Laboratory observations narrowed this window to seconds, making sustained automated polling more practical than isolated requests.
WordPress 7.1.4 randomizes staging directories, adds an index guard, and blocks unsafe promotion of staged configuration data. Unlike previously reported WordPress path-traversal RCE vulnerabilities, this attack depends on temporary upgrade artifacts rather than theme-template resolution.
According to the supplied Wordfence report, its firewall recorded the first matching exploit attempt nine minutes after deployment of a protective rule. More than 18,500 requests targeted staged setup-config.php paths during the first 21 hours.
Two prominent sources repeatedly polled small groups of websites for approximately 14.5 hours. These observations establish active exploitation attempts, not confirmed successful compromises.
The activity follows other WordPress attacks involving malicious plugins, although the entry mechanism differs.
Wordfence Premium, Care, and Response customers received protection on October 28 at 20:30 UTC. Free users are scheduled to receive the rule on November 27.
Administrators should confirm version 7.1.4 through Dashboard > Updates, or install the corresponding patched branch release. Security fixes extend through WordPress 4.7, but only the latest version is actively supported.
Wordfence users should enable Extended Protection because exploitation directly requests PHP files without loading WordPress first.
Review logs for unexpected PHP requests beneath wp-content/upgrade, investigate unfamiliar administrator accounts and plugins, and scan for unauthorized files. Firewall protection supplements patching; it does not replace the Core security update or establish that a previously exposed website remains uncompromised.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.
