Security · High impactFan score 66 · Tier A2 sources
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
The Hacker News ·
The Brief
- CISA warned federal agencies that attackers have started exploiting a recently patched high-severity WordPress remote code execution flaw in the wild.
- The flaw is a remote code execution (RCE) vulnerability in WordPress, which was already patched before exploitation was reported.
Why it matters
Attackers are actively exploiting this WordPress RCE flaw, so WordPress sites that have not applied the patch can be compromised.
Who’s affected
- WordPress site operators
- Teams running unpatched WordPress installations
What to do
- Apply the available WordPress patch for this RCE flaw as soon as possible
- #wordpress
- #security
- #vulnerability
- #rce
- #cisa
- #actively-exploited
Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an…
Timeline
CISA warns federal agencies that the WordPress RCE flaw is being actively exploited
BleepingComputer
CISA flags WordPress RCE flaw as actively exploited in attacks
The Hacker News
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
Full coverage · 2 sources
- 2h ago ↗
The Hacker News
Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time
- 2d ago ↗
BleepingComputer
CISA flags WordPress RCE flaw as actively exploited in attacks