Threat actors have been detected attempting to exploit a high-severity vulnerability in WordPress Core following the release of patches This article explores attacker requests installer. . Because the staging directory is web-accessible on many servers, an unauthenticated attacker who requests the installer at precisely the right moment can interact with the staged WordPress copy and progress to PHP code execution, according to Alex Thomas, who leads the Wordfence Threat Response Team.
A threat actor who can win the race condition can gain the ability to execute code on the server, provided the following conditions are met: a full-package update containing the installer files, public web and PHP access to the staging tree, a predictable or discovered staging path, and adequate time to complete the attack before WordPress cleans up the temporary files.
Two of the largest sources continuously monitored small groups of sites for roughly 14.5 hours, behavior consistent with attempting to exploit a brief upgrade window. While not every request used the exact vulnerable path, the sustained polling and exact-layout probes indicate attackers quickly understood the race condition and began targeting it.
