WordPress 7.1.4 Fixes an Update-Window Race That Allows Remote Code Execution; Wordfence Blocks 63,000 Attempts

WordPress has fixed a flaw in its core update process that can let an unauthenticated attacker run code on a site while an update is being installed. The advisory covers every version from 4.7.0 to 7.1.3, and the fix shipped in WordPress 7.1.4 on 28 October, with backports to each supported branch. Attackers are already trying it: Wordfence blocked 62,969 attacks in 24 hours, The Hacker News reports.

How the flaw works

During a core update, WordPress extracts the new files into place. The advisory describes it as a race: an attacker who "wins a race against that extraction could reach remote code execution", with no login needed. The window only exists while an update is running. The flaw was reported by Umut Bayram.

It has no CVE number yet, and WordPress's own advisory rates it "Low". The Hacker News gives a CVSS score of 8.1 without saying who assigned it.

It isn't in CISA's Known Exploited Vulnerabilities catalogue.

The attack attempts

The Hacker News quotes Wordfence saying two of the largest attack sources "repeatedly polled small groups of sites for roughly 14.5 hours", waiting for the moment an update starts.

The rest of the release

WordPress 7.1.4 also fixes stored cross-site scripting in the Interactivity API, the Categories block and the playlist and image blocks, and a stored denial-of-service issue. Part of the Interactivity API work is credited to AnC and DatNLQ of VietSunshine Cyber Security in Vietnam, alongside other researchers and the WordPress Security Team.

What to do

• WordPress 7.1: update to 7.1.4. WordPress calls it a security release and recommends updating immediately.
• Older branches: the fix is backported to every branch back to 4.7, including 7.0.8, 6.9.11, 6.8.12 and 4.7.39.