Severity: High | Priority: 1
This update adds one signature (SID 1001988) that detects attempts to exploit a newly disclosed weakness in WordPress Core. It affects every release from 4.7.0 up to and including 7.1.3. When WordPress installs a core update, it first unpacks the new release into a temporary folder under wp-content/upgrade, using a folder name that is easy to predict. For a few seconds, that folder contains a complete working copy of the WordPress setup wizard. On many servers it can be reached directly from the internet. An attacker who requests the setup wizard during that brief window can run it against a database they control. That leads to arbitrary PHP code running on the web server, which means full control of the site. No login or user interaction is required.
Because the window is short, attackers repeatedly poll the setup wizard path across many possible folder names, hoping to catch a site mid-update. Security researchers blocked close to 63,000 such attempts within a single day of the fix being released. Exploitation is a matter of timing rather than skill, and with automated sites updating unattended, attackers only need to get lucky once.
Administrators should update every WordPress installation to version 7.1.4, or to the corresponding patched release for older branches, as soon as possible. As an extra safeguard, block all web access to the wp-content/upgrade folder in the web server configuration, because WordPress only places a placeholder index file there and nothing in that folder needs to be public. On any site that has triggered this signature, check wp-content/upgrade for PHP files other than index.php. Look for a wp-config.php that was not created by your team, and for unfamiliar administrator accounts or plugins. Administrators can switch this signature from alert to drop to block these attempts at the perimeter.