Tens of thousands of attacks on WordPress after security flaw
WordPress Core versions 4.7 through 7.1.3 face exploitation attempts targeting predictable staging paths during full-package updates. Review patch details and update. How the problem works According to se
WordPress Core versions 4.7 through 7.1.3 face exploitation attempts targeting predictable staging paths during full-package updates.
Review patch details and update.
How the problem works
According to security firm Wordfence, the issue occurs during major WordPress upgrades. Specifically, when the system unzips the new files into a folder accessible from the internet, a very short window of time is created.
If someone attacks at the exact moment the upgrade is happening and manages to send a request before the temporary files are deleted, they could gain access. While this window of time is minimal, automated systems continuously monitored small groups of websites for about 14,5 hours to find the right time.
Attacks and what administrators should do
Within just 24 hours, the security company blocked 62.969 attempts targeting this specific vulnerability.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
TeamViewer fixes security flaw that allowed remote computer to attack the connected one
↗
Website administrators are urged to immediately update their systems to version 7.1.4. They are also advised to check for any suspicious requests, unknown administrator accounts, plugins, or files they do not recognize.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Originally published by Dev.to WebDev. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.