WordPress 7.1.4 parchea un fallo grave que permitía RCE durante las actualizaciones, más un montón de XSS almacenados en bloques e Interactivity API. Actualización recomendada por el equipo de seguridad. #WordPress #Security #Update
Dark Web Intelligence@DailyDarkWeb
🚨 WORDPRESS CORE RCE FLAW UNDER ATTACK HOURS AFTER PATCH (WordPress 7.1.4) WordPress pushed 7.1.4 on Oct 28 as a security release and told admins to update immediately. Wordfence (Defiant) says attackers started trying to exploit one of the fixed bugs within hours. • Race condition in WordPress Core's own update process, no login needed • New files get unpacked into a predictable, web-reachable staging folder, which can lead to remote code execution • Attack complexity is high: the window lasts only seconds, so attackers keep polling the staging paths • No CVE assigned yet. Fixed in WordPress 7.1.4 ⚠️ Analyst Note: Ironically, the bug fires during an update. Make sure 7.1.4 is installed, and block web access to wp-content/upgrade where you can. Source: https://t.co/sagTmAZm80 #DDW #WordPress #RCE #ActivelyExploited #PatchNow
- 0 réponses
- 0 partages
- 0 j'aime
- 14 vues
