WordPress core flaw allows remote takeover; update now, attacks seen
Original title：WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
What happened
WordPress 7.1.4 and backported releases fix 22 vulnerabilities, the worst being a race condition during core updates that can let unauthenticated attackers run code on the server. Wordfence reports attackers are already trying to exploit it, so confirm your site actually updated.
Who is affected
- Anyone running a WordPress site
- Agencies maintaining WordPress sites
What to do
Check Dashboard > Updates today and confirm you run 7.1.4 or the patched release for your branch; update manually if not. If you were unpatched, look for odd requests under wp-content/upgrade, unknown admins or plugins.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7 〜 7.1.3 | 7.1.4(各系統: 7.0.8, 6.9.11, 6.8.12 ほか。4.7.39 まで) |
Why this flag
サーバー乗っ取りに至る重大な欠陥で、第三者(Wordfence)が攻撃試行を観測。ただし成功には更新中の数秒の競合に勝つ必要があり、実際の悪用成功は未確認で、KEV等の公的確認もないため RED ではなく DOUBLE_YELLOW を提案。
Double yellow: great danger, be ready to stop — Severe impact with a public exploit or reported (unconfirmed) exploitation, including RED candidates under review.
Sources
- Source：Wordfence Blog ↗