WordPress has a seconds-long window during updates. Attackers are already polling it.
By Lior AharonovFounder, 7IT Solutions ·
What happened
WordPress 7.1.4 shipped on Wednesday 28 October with a fix for a race condition in the core update process that can lead to remote code execution. Defiant says attackers poll for the window while files unpack, and its firewall logged more than 18,500 requests to installer paths in 21 hours. No compromise has been reported.
Why it matters
Your own update is the opening. On many servers, a full core update unpacks into a predictable folder the web can reach, and for a few seconds that folder is the door.
What to do
Update every WordPress site to 7.1.4 today, or to the backported release for your branch. Then search your logs for requests to setup-config.php.
My take
Lior Aharonov
Founder, 7IT Solutions
The riskiest minute of a site's week is the one it spends updating itself.
Sources
| SecurityWeek: Fresh WordPress Vulnerability in Attackers' Crosshairs | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.