WordPress released version 7.1.4 on 28 October as a security release and told site owners to update immediately. One of the fixes closes “a weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window,” reported by Umut Bayram. The Hacker News reports the flaw has no CVE identifier, affects WordPress Core versions 4.7 through 7.1.3, and carries a CVSS score of 8.1.
According to Wordfence, quoted by The Hacker News, full-package core updates unpack their files into a predictable directory under wp-content/upgrade, and that copy includes the WordPress installer. If the directory is reachable from the web, an unauthenticated attacker who requests the installer at exactly the right moment can interact with the staged copy and reach PHP code execution. The window is narrow (Wordfence says seconds in lab conditions) and closes when WordPress cleans up the temporary files. Wordfence said it blocked 62,969 attacks aimed at the flaw in 24 hours, with two of the largest sources repeatedly polling small groups of sites for roughly 14.5 hours, consistent with waiting for an upgrade to start. These are blocked attempts; the sources do not report any confirmed compromises.
The 7.1.4 release also fixes a number of stored cross-site scripting issues, a stored denial-of-service issue in the Interactivity API and an unauthenticated customizer-changeset disclosure, and updates the bundled root certificates after the eMudhra revocation (see our earlier coverage: Go Emergency Update Blocks Eight eMudhra CA Keys).
How to check if you’re affected
Affected versions are WordPress Core 4.7 through 7.1.3, per The Hacker News. The fix is in version 7.1.4. The sources do not say whether older release branches received a backport, so check the WordPress.org release page for your branch.
- In the WordPress dashboard, open Dashboard > Updates and confirm the site reports version 7.1.4 or later. Sites with automatic background updates enabled will begin the update by themselves.
- Check your web server logs for requests to PHP files under
wp-content/upgrade(for examplesetup-config.php), the probing pattern Wordfence describes. - Look for administrator accounts, plugins or PHP files you do not recognize, which The Hacker News advises site owners to look for.
Sources
- WordPress.org News: WordPress 7.1.4
- Wordfence: WordPress Core 4.7 – 7.1.3 – Unauthenticated Upgrade-Window Staged Installer Remote Code Execution (page did not load for our checker; details taken from The Hacker News)
- The Hacker News: WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours