Just days after WordPress 7.1.4 patched a high-severity unauthenticated remote code execution (RCE) vulnerability, threat actors are already actively exploiting it in the wild. Security firm Defiant (Wordfence) reports that attackers began probing the vulnerability within nine minutes of their firewall rule deployment, with over 18,500 attack requests recorded in the first 21 hours alone.
What Is the Vulnerability?
The flaw is a race condition in WordPress Core update process that can be exploited without authentication. It stems from predictable, web-accessible staging paths used during the upgrade process. New files are unpacked into a predictable directory that is accessible from the web on many servers.
No CVE identifier has been assigned yet, but the attack complexity is rated as high. Successful exploitation requires:
- A full-package update containing the installer files
- Public web and PHP access to the staging tree
- A predictable or discovered staging path
- Timing the attack within the seconds-long exploitability window while WordPress is unpacking a Core update
How Attackers Are Exploiting It
According to Defiant, threat actors are repeatedly polling vulnerable paths in an attempt to hit the narrow window during which WordPress is unpacking a complete Core update. The attack targets the staged setup-config.php installer paths.
Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for their new firewall rule arrived nine minutes after deployment. During the first 21 hours, over 18,500 requests targeting staged setup-config.php installer paths were recorded. Wordfence has not yet reported any successful compromises, but the volume and speed of exploitation attempts underscores the urgency of patching.
What WordPress Did to Fix It
WordPress 7.1.4 addresses the vulnerability by randomizing the staging directory to eliminate predictability, adding an index guard to block direct web access, and preventing unsafe promotion of staged configuration data. The fix was included in WordPress 7.1.4 and backported to all branches through WordPress 4.7.
What You Need to Do Right Now
- Update to WordPress 7.1.4 immediately via Dashboard Updates
- Enable auto-updates for future security releases
- Install or update Wordfence for active firewall protection
- Ensure your web server does not serve files from temporary staging directories
- Monitor your logs for repeated requests to setup-config.php paths
Broader Context
WordPress 7.1.4 patched 22 security vulnerabilities total, including multiple XSS flaws, Interactivity API issues, an unauthenticated information disclosure bug, and an authorization weakness. The speed at which this vulnerability moved from patch to active exploitation in under 48 hours is a stark reminder of why keeping WordPress updated is non-negotiable.
Hashtags: #WordPress #WebSecurity #CyberSecurity #WordPressSecurity #RCE #WebDevelopment #WordPress714
Sources: Defiant/Wordfence Analysis | WordPress.org Release Notes | SecurityWeek Report