Insights Security & Privacy
WordPress sites: check you are on version 7.1.4 after attacks begin
The short version
Attackers are now exploiting a flaw in how WordPress updates itself. WordPress fixed it in version 7.1.4 on 28 October, so site owners or their web developers should confirm the site has that version or a newer one.
What happened
The flaw affects WordPress versions 4.7 up to 7.1.3. During a full update, WordPress briefly places temporary files where they can be reached over the internet. An attacker who gets there in time could use them to run their own code on the web server. No account is needed.
The US cybersecurity agency CISA confirmed on 3 November that the flaw is being used in real attacks. Security firm Wordfence reported blocking 13,095 attack attempts in one 24-hour period.
The attack depends on precise timing, so not every site is equally easy to hit.
Why it matters to you
Letting an attacker run code on your server is a serious breach. Reports say attackers used an earlier WordPress flaw to install hidden backdoors and steal data from small businesses and government organisations.
Turning on automatic updates does not guarantee the fix has installed. Until you have checked, you cannot be sure the site is protected.
What to do
Log in to your WordPress Dashboard, open Updates, and confirm the site shows version 7.1.4 or later. If it does not, update now, or ask your web developer or hosting company to do it.
Afterwards, look for administrator accounts, plugins or files you do not recognise.
Sources
- CISA flags WordPress RCE flaw as actively exploited in attacks BleepingComputer (opens in a new tab)
- WordPress Core bug added to CISA's exploited vulnerabilities list SC Media (opens in a new tab)
- CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code Cybersecurity News (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.