Tahdid ishtirokchilari WordPress Core'dagi yuqori jiddiylikdagi xavfsizlik zaifligini yamoqlar chiqarilgandan so'ng darhol foydalanishga urinishlari kuzatildi.
CVE identifikatori bo'lmagan ushbu zaiflik WordPress Core 4.7 dan 7.1.3 gacha bo'lgan versiyalarni ta'sir qiladigan masofaviy kod ijro etish (remote code execution) holatiga tegishli. U CVSS tizimida 8.1 ballga ega. Zaiflik uchun yamoqlar 2026-yil 28-oktabrda chiqarildi.
"Bu to'liq paketli yadro yangilanishlari paytida ishlatiladigan bashorat qilinadigan, veb orqali kirish mumkin bo'lgan tayyorlash yo'llari bilan bog'liq," deb aytdi Wordfence. "Bu autentifikatsiyadan o'tmagan hujumchilarga yangilanish oynasi davomida serverda kodni ijro etish imkonini beradi."
WordPress xavfsizlik kompaniyasi muvaffaqiyatli foydalanish uchun "hujumchi WordPress to'liq Core yangilanishini ochayotganda juda tor oynani urishi" kerakligini ta'kidladi.
Muammo shundaki, ta'sirlangan versiyalar to'liq paketli Core yangilanishining bir qismi bo'lgan yangi fayllarni "wp-content/upgrade" ostidagi bashorat qilinadigan katalogga ochadi. Bu nusxa WordPress o'rnatuvchisini ham o'z ichiga oladi.
"Tayyorlash katalogi ko'plab serverlarda veb orqali kirish mumkin bo'lganligi sababli, autentifikatsiyadan o'tmagan hujumchi aynan to'g'ri vaqtda o'rnatuvchini so'rab, tayyorlangan WordPress nusxasi bilan o'zaro aloqada bo'lishi va PHP kod ijrosiga o'tishi mumkin," deb aytdi Wordfence Threat Response Team rahbari Alex Thomas.
Ushbu poyga shartini yutgan tahdid ishtirokchisi serverda kodni ijro etish qobiliyatiga ega bo'lishi mumkin, agar quyidagi shartlar bajarilsa:
- O'rnatuvchi fayllarni o'z ichiga olgan to'liq paketli yangilanish
- Tayyorlash daraxtiga ommaviy veb va PHP kirish
- Bashorat qilinadigan yoki aniqlangan tayyorlash yo'li, va
- WordPress vaqtinchalik fayllarni tozalashdan oldin hujumni yakunlash uchun yetarli vaqt
Garchi bu oyna odatiy laboratoriya muhitlarida faqat bir necha soniya davom etishi kuzatilgan bo'lsa-da, tahdid ishtirokchilari zaif yo'llarni, masalan "setup-config.php" ni, zaiflikni ishga tushirishga urinishda qayta-qayta tekshirmoqda. So'nggi 24 soat ichida Wordfence ushbu zaiflikni nishonga olgan 62 969 hujumni bloklaganini aytdi.
"Eng yirik ikkita manba kichik saytlar guruhlarini taxminan 14,5 soat davomida qayta-qayta tekshirdi, bu xatti-harakat qisqa yangilanish oynasini ushlashga urinish bilan mos keladi," deb aytdi Thomas. "Boshqa manbalar ko'plab tayyorlash katalogi va versiya nomi o'zgarishlarini sinab ko'rdi."
"Har bir so'rov aynan zaif yo'lni ishlatmagan bo'lsa-da, doimiy tekshirish va aniq tartib tekshiruvlari hujumchilarning poyga shartini tezda tushunib, uni nishonga olishni boshlaganini ko'rsatadi."
Faol foydalanish urinishlari allaqachon davom etayotgani sababli, WordPress sayt egalari iloji boricha tezroq 7.1.4 versiyasiga yangilanishlari, shuningdek "wp-content/upgrade" ostidagi PHP fayllariga shubhali so'rovlarni, shuningdek notanish administrator hisoblari, plaginlar yoki PHP fayllarini tekshirishlari tavsiya etiladi.
Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released.
The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October 28, 2026.
"This is due to predictable, web-accessible staging paths used during full-package core upgrades," Wordfence said. "This makes it possible for unauthenticated attackers to execute code on the server during the upgrade window."
The WordPress security company noted that successful exploitation requires an "attacker to hit a very narrow window while WordPress is unpacking a complete Core update."
The issue boils down to the fact that affected versions unpack new files part of a full-package Core update into a predictable directory under "wp-content/upgrade." This copy also includes the WordPress installer.
"Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution," Alex Thomas, who leads the Wordfence Threat Response Team, said.
A threat actor who is able to win the race condition can gain the ability to execute code on the server, assuming the following conditions are met -
- A full-package update containing the installer files
- Public web and PHP access to the staging tree
- A predictable or discovered staging path, and
- Adequate time to complete the attack before WordPress cleans up the temporary files
Although that window has been observed to last only seconds in normal lab environments, threat actors are polling vulnerable paths, such as "setup-config.php," repeatedly in an attempt to trigger the flaw. Over the past 24 hours, Wordfence said it has blocked 62,969 attacks targeting the vulnerability.
"Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window," Thomas said. "Other sources tested many staging-directory and version-name variations."
"Not every request used the exact vulnerable path, but the sustained polling and exact-layout probes show that attackers quickly understood the race condition and began targeting it."
With active exploitation attempts already underway, WordPress site owners are advised to update to version 7.1.4 as soon as possible and look for suspicious requests to PHP files located under "wp-content/upgrade," as well as unfamiliar administrator accounts, plugins, or PHP files.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
